Add iOS/macOS MH_FILESET KernelCache View and loader.

This loader is inspired by/based on our dyld_shared_cache loader, following the same design language. It targets primarily the latest kernels, but should support any with the MH_FILESET format.

It allows you to decide which images you would like to map in (the kernel itself included), resulting in targeted analysis when you may only need to load a singular image.

It also supports dropping in compressed KernelCaches, directly from the ipsw.

This is an early solution and we have many more changes and improvements planned. We look forward to your feedback

10 files changed, 2406 insertions, 0 deletions

diff --git a/view/kernelcache/core/transformers/libDER/DER_Decode.c b/view/kernelcache/core/transformers/libDER/DER_Decode.c
new file mode 100644
index 00000000..3d08b616
--- /dev/null
+++ b/view/kernelcache/core/transformers/libDER/DER_Decode.c
@@ -0,0 +1,627 @@
+/*
+ * Copyright (c) 2005-2012 Apple Inc. All Rights Reserved.
+ * 
+ * @APPLE_LICENSE_HEADER_START@
+ * 
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ * 
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+/* 
+ * DER_Decode.c - DER decoding routines
+ */
+/*
+ * NOTICE: This file was modified by xerub to reflect binary code.
+ */
+ 
+#include <libDER/DER_Decode.h>
+#include <libDER/asn1Types.h>
+
+#include <libDER/libDER_config.h>
+
+#ifndef	DER_DECODE_ENABLE
+#error Please define DER_DECODE_ENABLE.
+#endif
+
+#if		DER_DECODE_ENABLE
+
+#define DER_DECODE_DEBUG	0
+#if		DER_DECODE_DEBUG
+#include <stdio.h>
+#define derDecDbg(a)			iprintf(a)
+#define derDecDbg1(a, b)		iprintf(a, b)
+#define derDecDbg2(a, b, c)		iprintf(a, b, c)
+#define derDecDbg3(a, b, c, d)	iprintf(a, b, c, d)
+#else	
+#define derDecDbg(a)	
+#define derDecDbg1(a, b)	
+#define derDecDbg2(a, b, c)	
+#define derDecDbg3(a, b, c, d)
+#endif	/* DER_DECODE_DEBUG */
+
+/*
+ *  Basic decoding primitive. Only works with:
+ *
+ *  -- definite length encoding 
+ *  -- one-byte tags 
+ *  -- max content length fits in a DERSize
+ *
+ * No malloc or copy of the contents is performed; the returned 
+ * content->content.data is a pointer into the incoming der data.
+ */
+DERReturn DERDecodeItem(
+	const DERItem	*der,			/* data to decode */
+	DERDecodedInfo	*decoded)		/* RETURNED */
+{
+    return DERDecodeItemPartialBuffer(der, decoded, false);
+}
+DERReturn DERDecodeItemPartialBuffer(
+	const DERItem	*der,			/* data to decode */
+	DERDecodedInfo	*decoded,		/* RETURNED */
+	bool partial)
+{
+	DERByte tag1;			/* first tag byte */
+	DERByte len1;			/* first length byte */
+	DERTag tagNumber;       /* tag number without class and method bits */
+	DERByte *derPtr = der->data;
+	DERSize derLen = der->length;
+	
+    /* The tag decoding below is fully BER complient.  We support a max tag
+       value of 2 ^ ((sizeof(DERTag) * 8) - 3) - 1 so for tag size 1 byte we
+       support tag values from 0 - 0x1F.  For tag size 2 tag values
+       from 0 - 0x1FFF and for tag size 4 values from 0 - 0x1FFFFFFF. */
+	if(derLen < 2) {
+		return DR_DecodeError;
+	}
+    /* Grab the first byte of the tag. */
+	tag1 = *derPtr++;
+	derLen--;
+	tagNumber = tag1 & 0x1F;
+	if(tagNumber == 0x1F) {
+#ifdef DER_MULTIBYTE_TAGS
+	if (*derPtr == 0x80 || *derPtr < 0x1F) {
+	    return DR_DecodeError;
+	}
+        /* Long tag form: bit 8 of each octet shall be set to one unless it is
+           the last octet of the tag */
+        const DERTag overflowMask = ((DERTag)0x7F << (sizeof(DERTag) * 8 - 7));
+        DERByte tagByte;
+        tagNumber = 0;
+        do {
+            if(derLen < 2 || (tagNumber & overflowMask) != 0) {
+                return DR_DecodeError;
+            }
+            tagByte = *derPtr++;
+            derLen--;
+            tagNumber = (tagNumber << 7) | (tagByte & 0x7F);
+        } while((tagByte & 0x80) != 0);
+	
+        /* Check for any of the top 3 reserved bits being set. */
+        if ((tagNumber & (overflowMask << 4)) != 0)
+#endif
+            return DR_DecodeError;
+	}
+    /* Returned tag, top 3 bits are class/method remaining bits are number. */
+    decoded->tag = ((DERTag)(tag1 & 0xE0) << ((sizeof(DERTag) - 1) * 8)) | tagNumber;
+
+    /* Tag decoding above ensured we have at least one more input byte left. */
+	len1 = *derPtr++;
+	derLen--;
+	if(len1 & 0x80) {
+		/* long length form - first byte is length of length */
+		DERSize longLen = 0;	/* long form length */
+		unsigned dex;
+
+		len1 &= 0x7f;
+		if((len1 > sizeof(DERSize)) || (len1 > derLen) || len1 == 0 || *derPtr == 0) {
+			/* no can do */
+			return DR_DecodeError;
+		}
+		for(dex=0; dex<len1; dex++) {
+			longLen <<= 8;
+			longLen |= *derPtr++;
+			derLen--;
+		}
+		if(longLen > derLen && !partial) {
+			/* not enough data left for this encoding */
+			return DR_DecodeError;
+		}
+		decoded->content.data = derPtr;
+		decoded->content.length = longLen;
+	}
+	else {
+		/* short length form, len1 is the length */
+		if(len1 > derLen && !partial) {
+			/* not enough data left for this encoding */
+			return DR_DecodeError;
+		}
+		decoded->content.data = derPtr;
+		decoded->content.length = len1;
+	}
+
+		return DR_Success;
+	}
+
+/* 
+ * Given a BIT_STRING, in the form of its raw content bytes, 
+ * obtain the number of unused bits and the raw bit string bytes.
+ */
+DERReturn DERParseBitString(
+	const DERItem	*contents,
+	DERItem			*bitStringBytes,	/* RETURNED */
+	DERByte			*numUnusedBits)		/* RETURNED */
+{
+	if(contents->length < 2) {
+		/* not enough room for actual bits after the unused bits field */
+		*numUnusedBits = 0;
+		bitStringBytes->data = NULL;
+		bitStringBytes->length = 0;
+		return DR_Success;
+	}
+	*numUnusedBits = contents->data[0];
+	bitStringBytes->data = contents->data + 1;
+	bitStringBytes->length = contents->length - 1;
+	return DR_Success;
+}
+
+/* 
+ * Given a BOOLEAN, in the form of its raw content bytes, 
+ * obtain it's value.
+ */
+DERReturn DERParseBoolean(
+	const DERItem	*contents,
+	bool			*value) {	/* RETURNED */
+    if (contents->length != 1 ||
+        (contents->data[0] != 0 && contents->data[0] != 0xFF))
+        return DR_DecodeError;
+
+    *value = contents->data[0] != 0;
+    return DR_Success;
+}
+
+DERReturn DERParseInteger(
+	const DERItem	*contents,
+	uint32_t        *result) {	/* RETURNED */
+	uint64_t value;
+	DERReturn drtn = DERParseInteger64(contents, &value);
+	if (drtn) {
+		return drtn;
+	}
+	if (value >> 32) {
+		return DR_BufOverflow;
+	}
+	*result = value;
+	return DR_Success;
+}
+
+DERReturn DERParseInteger64(
+	const DERItem	*contents,
+	uint64_t        *result) {	/* RETURNED */
+    const char *data = (char *)contents->data;
+    DERSize length = contents->length;
+    uint64_t value = 0;
+
+    if (length == 0 || data[0] < 0) {
+        return DR_DecodeError;
+    }
+
+    if (data[0] == 0) {
+        if (length >= 2) {
+            if (data[1] >= 0) {
+                return DR_DecodeError;
+            }
+            if (length > 9) {
+                return DR_BufOverflow;
+            }
+        }
+    } else if (length > 8) {
+        return DR_BufOverflow;
+    }
+
+    while (length--) {
+        value <<= 8;
+        value += *(unsigned char *)data++;
+    }
+    *result = value;
+    return DR_Success;
+}
+
+/* Sequence/set support */
+
+/* 
+ * To decode a set or sequence, call DERDecodeSeqInit once, then
+ * call DERDecodeSeqNext to get each enclosed item.
+ * DERDecodeSeqNext returns DR_EndOfSequence when no more
+ * items are available. 
+ */
+DERReturn DERDecodeSeqInit(
+	const DERItem	*der,			/* data to decode */
+	DERTag			*tag,			/* RETURNED tag of sequence/set. This will be
+									 * either ASN1_CONSTR_SEQUENCE or ASN1_CONSTR_SET. */
+	DERSequence		*derSeq)		/* RETURNED, to use in DERDecodeSeqNext */
+{
+	DERDecodedInfo decoded;
+	DERReturn drtn;
+	
+	drtn = DERDecodeItem(der, &decoded);
+	if(drtn) {
+		return drtn;
+	}
+    *tag = decoded.tag;
+	switch(decoded.tag) {
+		case ASN1_CONSTR_SEQUENCE:
+		case ASN1_CONSTR_SET:
+			break;
+		default:
+			return DR_UnexpectedTag;
+	}
+	derSeq->nextItem = decoded.content.data;
+	derSeq->end = decoded.content.data + decoded.content.length;
+	return DR_Success;
+}
+
+/* 
+ * Use this to start in on decoding a sequence's content, when 
+ * the top-level tag and content have already been decoded. 
+ */
+DERReturn DERDecodeSeqContentInit(
+	const DERItem	*content,
+	DERSequence		*derSeq)		/* RETURNED, to use in DERDecodeSeqNext */
+{
+	/* just prepare for decoding items in content */
+	derSeq->nextItem = content->data;
+	derSeq->end = content->data + content->length;
+	return DR_Success;
+}
+
+DERReturn DERDecodeSeqNext(
+	DERSequence		*derSeq,
+	DERDecodedInfo	*decoded)		/* RETURNED */
+{
+	DERReturn drtn;
+	DERItem item;
+	
+	if(derSeq->nextItem >= derSeq->end) {
+		/* normal termination, contents all used up */
+		return DR_EndOfSequence;
+	}
+	
+	/* decode next item */
+	item.data = derSeq->nextItem;
+	item.length = derSeq->end - derSeq->nextItem;
+	drtn = DERDecodeItem(&item, decoded);
+	if(drtn) {
+		return drtn;
+	}	
+	
+	/* skip over the item we just decoded */
+	derSeq->nextItem = decoded->content.data + decoded->content.length;
+	return DR_Success;
+}
+
+/* 
+ * High level sequence parse, starting with top-level tag and content.
+ * Top level tag must be ASN1_CONSTR_SEQUENCE - if it's not, and that's 
+ * OK, use DERParseSequenceContent().
+ */
+DERReturn DERParseSequence(
+	const DERItem			*der,
+	DERShort				numItems,	/* size of itemSpecs[] */
+	const DERItemSpec		*itemSpecs,
+	void					*dest,		/* DERDecodedInfo(s) here RETURNED */
+	DERSize					sizeToZero)	/* optional */
+{
+	DERReturn drtn;
+	DERDecodedInfo topDecode;
+	
+	drtn = DERDecodeItem(der, &topDecode);
+	if(drtn) {
+		return drtn;
+	}
+	if(topDecode.tag != ASN1_CONSTR_SEQUENCE) {
+		return DR_UnexpectedTag;
+	}
+	return DERParseSequenceContent(&topDecode.content,
+		numItems, itemSpecs, dest, sizeToZero);
+}
+
+/* high level sequence parse, starting with sequence's content */
+DERReturn DERParseSequenceContent(
+	const DERItem			*content,
+	DERShort				numItems,	/* size of itemSpecs[] */
+	const DERItemSpec		*itemSpecs,
+	void					*dest,		/* DERDecodedInfo(s) here RETURNED */
+	DERSize					sizeToZero)	/* optional */
+{
+	DERSequence			derSeq;
+	DERReturn			drtn;
+	DERShort			itemDex;
+	DERByte				*currDER;	/* full DER encoding of current item */
+	
+	if(sizeToZero) {
+		DERMemset(dest, 0, sizeToZero);
+	}
+	
+	drtn = DERDecodeSeqContentInit(content, &derSeq);
+	if(drtn) {
+		return drtn;
+	}
+	
+	/* main loop */
+	for(itemDex=0 ; itemDex<numItems; ) {
+		DERDecodedInfo currDecoded;
+		DERShort i;
+		DERTag foundTag;
+		char foundMatch = 0;
+		
+		/* save this in case of DER_DEC_SAVE_DER */
+		currDER = derSeq.nextItem;
+		
+		drtn = DERDecodeSeqNext(&derSeq, &currDecoded);
+		if(drtn) {
+			/* 
+			 * One legal error here is DR_EndOfSequence when 
+			 * all remaining DERSequenceItems are optional. 
+			 */
+			if(drtn == DR_EndOfSequence) {
+				for(i=itemDex; i<numItems; i++) {
+					if(!(itemSpecs[i].options & DER_DEC_OPTIONAL)) {
+						/* unexpected end of sequence */
+						return DR_IncompleteSeq;
+					}
+				}
+				/* the rest are optional; success */
+				return DR_Success;
+			}
+			else {
+				/* any other error is fatal */
+				return drtn;
+			}
+		}	/* decode error */
+		
+		/* 
+		 * Seek matching tag or ASN_ANY in itemSpecs, skipping 
+		 * over optional items.
+		 */
+		foundTag = currDecoded.tag;
+		derDecDbg1("--- foundTag 0x%x\n", foundTag);
+		
+		for(i=itemDex; i<numItems; i++) {
+			const DERItemSpec *currItemSpec = &itemSpecs[i];
+			DERShort currOptions = currItemSpec->options;
+			derDecDbg3("--- currItem %u expectTag 0x%x currOptions 0x%x\n", 
+				i, currItemSpec->tag, currOptions);
+			
+			if((currOptions & DER_DEC_ASN_ANY) ||
+			   (foundTag == currItemSpec->tag)) {
+				/* 
+				 * We're good with this one. Cook up destination address
+				 * as appropriate. 
+				 */
+				if(!(currOptions & DER_DEC_SKIP)) {
+					derDecDbg1("--- MATCH at currItem %u\n", i);
+					DERByte *byteDst = (DERByte *)dest + currItemSpec->offset;
+					DERItem *dst = (DERItem *)byteDst;
+					*dst = currDecoded.content;
+					if(currOptions & DER_DEC_SAVE_DER) {
+						/* recreate full DER encoding of this item */
+						derDecDbg1("--- SAVE_DER at currItem %u\n", i);
+						dst->data = currDER;
+						dst->length += (currDecoded.content.data - currDER);
+					}
+				}
+
+				/* on to next item */
+				itemDex = i + 1;
+				
+				/* is this the end? */
+				if(itemDex == numItems) {
+					/* normal termination if we consumed everything */
+					if (derSeq.nextItem == derSeq.end)
+						return DR_Success;
+					else
+						return DR_DecodeError;
+				}
+				else {
+					/* on to next item */ 
+					foundMatch = 1;
+					break;
+				}
+			} /* ASN_ANY, or match */
+			
+			/* 
+			 * If current itemSpec isn't optional, abort - else on to 
+			 * next item
+			 */
+			if(!(currOptions & DER_DEC_OPTIONAL)) {
+				derDecDbg1("--- MISMATCH at currItem %u, !OPTIONAL, abort\n", i);
+				return DR_UnexpectedTag;
+			}
+			
+			/* else this was optional, on to next item */
+		} /* searching for tag match */
+		
+		if(foundMatch == 0) {
+			/* 
+			 * Found an item we couldn't match to any tag spec and we're at
+			 * the end. 
+			 */
+			derDecDbg("--- TAG NOT FOUND, abort\n");
+			return DR_UnexpectedTag;
+		}
+		
+		/* else on to next item */
+	}	/* main loop */
+	
+	/*
+	 * If we get here, there appears to be more to process, but we've
+	 * given the caller everything they want. 
+	 */
+	return (derSeq.nextItem == derSeq.end) ? DR_Success : DR_DecodeError;
+}
+
+#if 0
+/* 
+ * High level sequence parse, starting with top-level tag and content.
+ * Top level tag must be ASN1_CONSTR_SEQUENCE - if it's not, and that's 
+ * OK, use DERParseSequenceContent().
+ */
+DERReturn DERParseSequenceOf(
+	const DERItem			*der,
+	DERShort				numItems,	/* size of itemSpecs[] */
+	const DERItemSpec		*itemSpecs,
+	void					*dest,		/* DERDecodedInfo(s) here RETURNED */
+	DERSize					*numDestItems)	/* output */
+{
+	DERReturn drtn;
+	DERDecodedInfo topDecode;
+	
+	drtn = DERDecodeItem(der, &topDecode);
+	if(drtn) {
+		return drtn;
+	}
+	if(topDecode.tag != ASN1_CONSTR_SEQUENCE) {
+		return DR_UnexpectedTag;
+	}
+	return DERParseSequenceContent(&topDecode.content,
+		numItems, itemSpecs, dest, sizeToZero);
+}
+
+/* 
+ * High level set of parse, starting with top-level tag and content.
+ * Top level tag must be ASN1_CONSTR_SET - if it's not, and that's 
+ * OK, use DERParseSetOrSequenceOfContent().
+ */
+DERReturn DERParseSetOf(
+	const DERItem			*der,
+	DERShort				numItems,	/* size of itemSpecs[] */
+	const DERItemSpec		*itemSpecs,
+	void					*dest,		/* DERDecodedInfo(s) here RETURNED */
+	DERSize					*numDestItems)	/* output */
+{
+	DERReturn drtn;
+	DERDecodedInfo topDecode;
+	
+	drtn = DERDecodeItem(der, &topDecode);
+	if(drtn) {
+		return drtn;
+	}
+	if(topDecode.tag != ASN1_CONSTR_SET) {
+		return DR_UnexpectedTag;
+	}
+	return DERParseSetOrSequenceOfContent(&topDecode.content,
+		numItems, itemSpecs, dest, numDestItems);
+}
+
+/* High level set of or sequence of parse, starting with set or
+   sequence's content */
+DERReturn DERParseSetOrSequenceOfContent(
+    const DERItem			*content,
+    void(*itemHandeler)(void *, const DERDecodedInfo *)
+	void					*itemHandelerContext);
+{
+    DERSequence			derSeq;
+    DERShort			itemDex;
+
+    drtn = DERDecodeSeqContentInit(content, &derSeq);
+    require_noerr_quiet(drtn, badCert);
+
+    /* main loop */
+    for (;;) {
+        DERDecodedInfo currDecoded;
+        DERShort i;
+        DERByte foundTag;
+        char foundMatch = 0;
+
+        drtn = DERDecodeSeqNext(&derSeq, &currDecoded);
+        if(drtn) {
+            /* The only legal error here is DR_EndOfSequence. */
+            if(drtn == DR_EndOfSequence) {
+                /* no more items left in the sequence; success */
+                return DR_Success;
+            }
+            else {
+                /* any other error is fatal */
+                require_noerr_quiet(drtn, badCert);
+            }
+        }	/* decode error */
+        
+        /* Each element can be anything. */
+        foundTag = currDecoded.tag;
+
+        /* 
+         * We're good with this one. Cook up destination address
+         * as appropriate. 
+         */
+        DERByte *byteDst = (DERByte *)dest + currItemSpec->offset;
+        DERItem *dst = (DERItem *)byteDst;
+        *dst = currDecoded.content;
+        if(currOptions & DER_DEC_SAVE_DER) {
+            /* recreate full DER encoding of this item */
+            derDecDbg1("--- SAVE_DER at currItem %u\n", i);
+            dst->data = currDER;
+            dst->length += (currDecoded.content.data - currDER);
+        }
+
+        /* on to next item */
+        itemDex = i + 1;
+        
+        /* is this the end? */
+        if(itemDex == numItems) {
+            /* normal termination */
+            return DR_Success;
+        }
+        else {
+            /* on to next item */ 
+            foundMatch = 1;
+            break;
+        }
+            
+            /* 
+             * If current itemSpec isn't optional, abort - else on to 
+             * next item
+             */
+            if(!(currOptions & DER_DEC_OPTIONAL)) {
+                derDecDbg1("--- MISMATCH at currItem %u, !OPTIONAL, abort\n", i);
+                return DR_UnexpectedTag;
+            }
+            
+            /* else this was optional, on to next item */
+        } /* searching for tag match */
+        
+        if(foundMatch == 0) {
+            /* 
+             * Found an item we couldn't match to any tag spec and we're at
+             * the end. 
+             */
+            derDecDbg("--- TAG NOT FOUND, abort\n");
+            return DR_UnexpectedTag;
+        }
+        
+        /* else on to next item */
+    }	/* main loop */
+
+    /*
+     * If we get here, there appears to be more to process, but we've
+     * given the caller everything they want. 
+     */
+    return DR_Success;
+    }
+}
+#endif
+
+#endif	/* DER_DECODE_ENABLE */
diff --git a/view/kernelcache/core/transformers/libDER/DER_Decode.h b/view/kernelcache/core/transformers/libDER/DER_Decode.h
new file mode 100644
index 00000000..403458b4
--- /dev/null
+++ b/view/kernelcache/core/transformers/libDER/DER_Decode.h
@@ -0,0 +1,206 @@
+/*
+ * Copyright (c) 2005-2011 Apple Inc. All Rights Reserved.
+ * 
+ * @APPLE_LICENSE_HEADER_START@
+ * 
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ * 
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+/* 
+ * DER_Decode.h - DER decoding routines
+ */
+/*
+ * NOTICE: This file was modified by xerub to reflect binary code.
+ */
+ 
+#ifndef	_DER_DECODE_H_
+#define _DER_DECODE_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <libDER/libDER.h>
+#include <stdbool.h>
+
+/*
+ * Decoding one item consists of extracting its tag, a pointer
+ * to the actual content, and the length of the content. Those
+ * three are represented by a DERDecodedInfo.
+ */
+typedef struct {
+	DERTag		tag;
+	DERItem		content;
+} DERDecodedInfo;
+
+/*
+ * Basic decoding primitive. Only works with:
+ *
+ *  -- definite length encoding 
+ *  -- one-byte tags 
+ *  -- max content length fits in a DERSize
+ *
+ * No malloc or copy of the contents is performed; the returned 
+ * content->content.data is a pointer into the incoming der data.
+ */
+DERReturn DERDecodeItem(
+	const DERItem	*der,			/* data to decode */
+	DERDecodedInfo	*decoded);		/* RETURNED */
+
+DERReturn DERDecodeItemPartialBuffer(
+	const DERItem	*der,			/* data to decode */
+	DERDecodedInfo	*decoded,		/* RETURNED */
+	bool partial);
+
+/* 
+ * Given a BIT_STRING, in the form of its raw content bytes, 
+ * obtain the number of unused bits and the raw bit string bytes.
+ */
+DERReturn DERParseBitString(
+	const DERItem	*contents,
+	DERItem			*bitStringBytes,	/* RETURNED */
+	DERByte			*numUnusedBits);	/* RETURNED */
+
+/* 
+ * Given a BOOLEAN, in the form of its raw content bytes, 
+ * obtain it's value.
+ */
+DERReturn DERParseBoolean(
+	const DERItem	*contents,
+	bool			*value);	/* RETURNED */
+
+DERReturn DERParseInteger(
+	const DERItem	*contents,
+	uint32_t        *value);	/* RETURNED */
+
+DERReturn DERParseInteger64(
+	const DERItem	*contents,
+	uint64_t        *value);	/* RETURNED */
+
+/* 
+ * Sequence/set decode support.
+ */
+ 
+/* state representing a sequence or set being decoded */
+typedef struct {
+	DERByte	*nextItem;
+	DERByte	*end;
+} DERSequence;
+
+/* 
+ * To decode a set or sequence, call DERDecodeSeqInit or
+ * DERDecodeSeqContentInit once, then call DERDecodeSeqNext to 
+ * get each enclosed item. 
+ *
+ * DERDecodeSeqNext returns DR_EndOfSequence when no more
+ * items are available. 
+ */
+ 
+/* 
+ * Use this to parse the top level sequence's tag and content length.
+ */
+DERReturn DERDecodeSeqInit(
+	const DERItem	*der,			/* data to decode */
+	DERTag			*tag,			/* RETURNED tag of sequence/set. This will be
+									 *    either ASN1_CONSTR_SEQUENCE or 
+									 *    ASN1_CONSTR_SET. */
+	DERSequence		*derSeq);		/* RETURNED, to use in DERDecodeSeqNext */
+	
+/* 
+ * Use this to start in on decoding a sequence's content, when 
+ * the top-level tag and content have already been decoded. 
+ */
+DERReturn DERDecodeSeqContentInit(
+	const DERItem	*content,
+	DERSequence		*derSeq);		/* RETURNED, to use in DERDecodeSeqNext */
+
+/* obtain the next decoded item in a sequence or set */
+DERReturn DERDecodeSeqNext(
+	DERSequence		*derSeq,
+	DERDecodedInfo	*decoded);		/* RETURNED */
+	
+/*
+ * High level sequence decode.
+ */
+
+/* 
+ * Per-item decode options.
+ */
+ 
+/* Explicit default, no options */
+#define DER_DEC_NO_OPTS		0x0000
+
+/* This item optional, can be skipped during decode */
+#define DER_DEC_OPTIONAL	0x0001	
+
+/* Skip the tag check; accept anything. */
+#define DER_DEC_ASN_ANY		0x0002	
+
+/* Skip item, no write to DERDecodedInfo (but tag check still performed) */
+#define DER_DEC_SKIP		0x0004		
+
+/* Save full DER encoding in DERDecodedInfo, including tag and length. Normally
+ * only the content is saved. */
+#define DER_DEC_SAVE_DER	0x0008
+
+/* 
+ * High level sequence parse, starting with top-level tag and content.
+ * Top level tag must be ASN1_CONSTR_SEQUENCE - if it's not, and that's 
+ * OK, use DERParseSequenceContent().
+ *
+ * These never return DR_EndOfSequence - if an *unexpected* end of sequence
+ * occurs, return DR_IncompleteSeq.
+ *
+ * Results of the decoding of one item are placed in a DERItem whose address 
+ * is the dest arg plus the offset value in the associated DERItemSpec. 
+ *
+ * Items which are optional (DER_DEC_OPTIONAL) and which are not found, 
+ * leave their associated DERDecodedInfos unmodified.
+ *
+ * Processing of a sequence ends on detection of any error or after the
+ * last DERItemSpec is processed. 
+ *
+ * The sizeToZero argument, if nonzero, indicates the number of bytes
+ * starting at dest to zero before processing the sequence. This is 
+ * generally desirable, particularly if there are any DER_DEC_OPTIONAL
+ * items in the sequence; skipped optional items are detected by the 
+ * caller via a NULL DERDecodedInfo.content.data; if this hasn't been
+ * explicitly zeroed (generally, by passing a nonzero value of sizeToZero),
+ * skipped items can't be detected. 
+ */
+DERReturn DERParseSequence(
+	const DERItem			*der,
+	DERShort				numItems,		/* size of itemSpecs[] */
+	const DERItemSpec		*itemSpecs,
+	void					*dest,			/* DERDecodedInfo(s) here RETURNED */
+	DERSize					sizeToZero);	/* optional */
+	
+/* high level sequence parse, starting with sequence's content */
+DERReturn DERParseSequenceContent(
+	const DERItem			*content,
+	DERShort				numItems,		/* size of itemSpecs[] */
+	const DERItemSpec		*itemSpecs,
+	void					*dest,			/* DERDecodedInfo(s) here RETURNED */
+	DERSize					sizeToZero);	/* optional */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* _DER_DECODE_H_ */
+
diff --git a/view/kernelcache/core/transformers/libDER/DER_Encode.c b/view/kernelcache/core/transformers/libDER/DER_Encode.c
new file mode 100644
index 00000000..9b694617
--- /dev/null
+++ b/view/kernelcache/core/transformers/libDER/DER_Encode.c
@@ -0,0 +1,365 @@
+/*
+ * Copyright (c) 2005-2007,2011,2014 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ * 
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ * 
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+
+/*
+ * DER_Encode.h - DER encoding routines
+ *
+ */
+
+#include <libDER/DER_Encode.h>
+#include <libDER/asn1Types.h>
+#include <libDER/libDER_config.h>
+#include <libDER/DER_Decode.h>
+
+#ifndef	DER_ENCODE_ENABLE
+#error Please define DER_ENCODE_ENABLE.
+#endif
+
+#if		DER_ENCODE_ENABLE
+
+/* calculate size of encoded tag */
+static DERSize DERLengthOfTag(
+	DERTag tag)
+{
+	DERSize rtn = 1;
+
+    tag &= ASN1_TAGNUM_MASK;
+    if (tag >= 0x1F) {
+        /* Shift 7-bit digits out of the tag integer until it's zero. */
+        while(tag != 0) {
+            rtn++;
+            tag >>= 7;
+        }
+    }
+
+    return rtn;
+}
+
+/* encode tag */
+static DERReturn DEREncodeTag(
+	DERTag tag,
+	DERByte *buf,		/* encoded length goes here */
+	DERSize *inOutLen)	/* IN/OUT */
+{
+    DERSize outLen = DERLengthOfTag(tag);
+    DERTag tagNumber = tag & ASN1_TAGNUM_MASK;
+    DERByte tag1 = (tag >> (sizeof(DERTag) * 8 - 8)) & 0xE0;
+
+	if(outLen > *inOutLen) {
+		return DR_BufOverflow;
+	}
+
+    if(outLen == 1) {
+		/* short form */
+		*buf = tag1 | tagNumber;
+	}
+	else {
+        /* long form */
+        DERByte *tagBytes = buf + outLen;	// l.s. digit of tag
+        *buf = tag1 | 0x1F;                 // tag class / method indicator
+        *--tagBytes = tagNumber & 0x7F;
+        tagNumber >>= 7;
+        while(tagNumber != 0) {
+            *--tagBytes = (tagNumber & 0x7F) | 0x80;
+            tagNumber >>= 7;
+        }
+    }
+	*inOutLen = outLen;
+	return DR_Success;
+}
+
+/* calculate size of encoded length */
+DERSize DERLengthOfLength(
+	DERSize length)
+{
+	DERSize rtn;
+	
+	if(length < 0x80) {
+		/* short form length */
+		return 1;
+	}
+	
+	/* long form - one length-of-length byte plus length bytes */
+	rtn = 1;
+	while(length != 0) {
+		rtn++;
+		length >>= 8;
+	}
+	return rtn;
+}
+
+/* encode length */
+DERReturn DEREncodeLength(
+	DERSize length,
+	DERByte *buf,		/* encoded length goes here */
+	DERSize *inOutLen)	/* IN/OUT */
+{
+	DERByte *lenBytes;
+	DERSize outLen = DERLengthOfLength(length);
+	
+	if(outLen > *inOutLen) {
+		return DR_BufOverflow;
+	}
+	
+	if(length < 0x80) {
+		/* short form */
+		*buf = (DERByte)length;
+		*inOutLen = 1;
+		return DR_Success;
+	}
+	
+	/* long form */
+	*buf = (outLen - 1) | 0x80;		// length of length, long form indicator
+	lenBytes = buf + outLen - 1;	// l.s. digit of length 
+	while(length != 0) {
+		*lenBytes-- = (DERByte)length;
+		length >>= 8;
+	}
+	*inOutLen = outLen;
+	return DR_Success;
+}
+
+DERSize DERLengthOfItem(
+	DERTag tag,
+	DERSize length)
+{
+    return DERLengthOfTag(tag) + DERLengthOfLength(length) + length;
+}
+
+DERReturn DEREncodeItem(
+	DERTag tag,
+	DERSize length,
+    const DERByte *src,
+	DERByte *derOut,	/* encoded item goes here */
+	DERSize *inOutLen)	/* IN/OUT */
+{
+	DERReturn		drtn;
+	DERSize			itemLen;
+	DERByte			*currPtr = derOut;
+	DERSize         bytesLeft = DERLengthOfItem(tag, length);
+	if(bytesLeft > *inOutLen) {
+		return DR_BufOverflow;
+	}
+	*inOutLen = bytesLeft;
+
+	/* top level tag */
+	itemLen = bytesLeft;
+	drtn = DEREncodeTag(tag, currPtr, &itemLen);
+	if(drtn) {
+		return drtn;
+	}
+	currPtr += itemLen;
+	bytesLeft -= itemLen;
+	itemLen = bytesLeft;
+	drtn = DEREncodeLength(length, currPtr, &itemLen);
+	if(drtn) {
+		return drtn;
+	}
+	currPtr += itemLen;
+	bytesLeft -= itemLen;
+	DERMemmove(currPtr, src, length);
+
+    (void) bytesLeft;
+    
+	return DR_Success;
+}
+
+static /* calculate the content length of an encoded sequence */
+DERSize DERContentLengthOfEncodedSequence(
+	const void			*src,		/* generally a ptr to a struct full of 
+									 *    DERItems */
+	DERShort			numItems,	/* size of itemSpecs[] */
+	const DERItemSpec	*itemSpecs)
+{
+	DERSize contentLen = 0;
+	unsigned dex;
+	DERSize thisContentLen;
+	
+	/* find length of each item */
+	for(dex=0; dex<numItems; dex++) {
+		const DERItemSpec *currItemSpec = &itemSpecs[dex];
+		DERShort currOptions = currItemSpec->options;
+		const DERByte *byteSrc = (const DERByte *)src + currItemSpec->offset;
+		const DERItem *itemSrc = (const DERItem *)byteSrc;
+
+		if(currOptions & DER_ENC_WRITE_DER) {
+			/* easy case - no encode */
+			contentLen += itemSrc->length;
+			continue;
+		}
+		
+        if ((currOptions & DER_DEC_OPTIONAL) && itemSrc->length == 0) {
+            /* If an optional item isn't present we don't encode a
+               tag and len. */
+            continue;
+        }
+
+		/* 
+		 * length of this item = 
+		 *   tag (one byte) +
+		 *   length of length +
+		 *   content length +
+		 *   optional zero byte for signed integer
+		 */
+		contentLen += DERLengthOfTag(currItemSpec->tag);
+		
+		/* check need for pad byte before calculating lengthOfLength... */
+		thisContentLen = itemSrc->length;
+		if((currOptions & DER_ENC_SIGNED_INT) &&
+		   (itemSrc->length != 0)) {
+			if(itemSrc->data[0] & 0x80) {
+				/* insert zero keep it positive */
+				thisContentLen++;
+			}
+		}
+		contentLen += DERLengthOfLength(thisContentLen);
+		contentLen += thisContentLen;
+	}
+	return contentLen;
+}
+
+DERReturn DEREncodeSequence(
+	DERTag				topTag,		/* ASN1_CONSTR_SEQUENCE, ASN1_CONSTR_SET */
+	const void			*src,		/* generally a ptr to a struct full of 
+									 *    DERItems */
+	DERShort			numItems,	/* size of itemSpecs[] */
+	const DERItemSpec	*itemSpecs,
+	DERByte				*derOut,	/* encoded data written here */
+	DERSize				*inOutLen)	/* IN/OUT */
+{
+	const DERByte	*endPtr = derOut + *inOutLen;
+	DERByte			*currPtr = derOut;
+	DERSize			bytesLeft = *inOutLen;
+	DERSize			contentLen;
+	DERReturn		drtn;
+	DERSize			itemLen;
+	unsigned		dex;
+	
+	/* top level tag */
+	itemLen = bytesLeft;
+    drtn = DEREncodeTag(topTag, currPtr, &itemLen);
+	if(drtn) {
+		return drtn;
+	}
+	currPtr += itemLen;
+	bytesLeft -= itemLen;
+	if(currPtr >= endPtr) {	
+		return DR_BufOverflow;
+	}
+	
+	/* content length */
+	contentLen = DERContentLengthOfEncodedSequence(src, numItems, itemSpecs);	
+	itemLen = bytesLeft;
+	drtn = DEREncodeLength(contentLen, currPtr, &itemLen);
+	if(drtn) {
+		return drtn;
+	}
+	currPtr += itemLen;
+	bytesLeft -= itemLen;
+	if(currPtr + contentLen > endPtr) {
+		return DR_BufOverflow;
+	}
+	/* we don't have to check for overflow any more */
+	
+	/* grind thru the items */
+	for(dex=0; dex<numItems; dex++) {
+		const DERItemSpec *currItemSpec = &itemSpecs[dex];
+		DERShort currOptions = currItemSpec->options;
+		const DERByte *byteSrc = (const DERByte *)src + currItemSpec->offset;
+		const DERItem *itemSrc = (const DERItem *)byteSrc;
+		int prependZero = 0;
+		
+		if(currOptions & DER_ENC_WRITE_DER) {
+			/* easy case */
+			DERMemmove(currPtr, itemSrc->data, itemSrc->length);
+			currPtr += itemSrc->length;
+			bytesLeft -= itemSrc->length;
+			continue;
+		}
+
+        if ((currOptions & DER_DEC_OPTIONAL) && itemSrc->length == 0) {
+            /* If an optional item isn't present we skip it. */
+            continue;
+        }
+
+        /* encode one item: first the tag */
+        itemLen = bytesLeft;
+        drtn = DEREncodeTag(currItemSpec->tag, currPtr, &itemLen);
+        if(drtn) {
+            return drtn;
+        }
+        currPtr += itemLen;
+        bytesLeft -= itemLen;
+		
+		/* do we need to prepend a zero to content? */
+		contentLen = itemSrc->length;
+		if((currOptions & DER_ENC_SIGNED_INT) &&
+		   (itemSrc->length != 0)) {
+			if(itemSrc->data[0] & 0x80) {
+				/* insert zero keep it positive */
+				contentLen++;
+				prependZero = 1;
+			}
+		}
+
+		/* encode content length */
+		itemLen = bytesLeft;
+		drtn = DEREncodeLength(contentLen, currPtr, &itemLen);
+		if(drtn) {
+			return drtn;
+		}
+		currPtr += itemLen;
+		bytesLeft -= itemLen;
+		
+		/* now the content, with possible leading zero added */
+		if(prependZero) {
+			*currPtr++ = 0;
+			bytesLeft--;
+		}
+		DERMemmove(currPtr, itemSrc->data, itemSrc->length);
+		currPtr += itemSrc->length;
+		bytesLeft -= itemSrc->length;
+	}
+	*inOutLen = (currPtr - derOut);
+	return DR_Success;
+}
+
+/* calculate the length of an encoded sequence. */
+DERSize DERLengthOfEncodedSequence(
+    DERTag				topTag,
+	const void			*src,		/* generally a ptr to a struct full of 
+									 *    DERItems */
+	DERShort			numItems,	/* size of itemSpecs[] */
+	const DERItemSpec	*itemSpecs)
+{
+	DERSize contentLen = DERContentLengthOfEncodedSequence(
+		src, numItems, itemSpecs);
+		
+	return DERLengthOfTag(topTag) +
+		DERLengthOfLength(contentLen) +
+		contentLen;
+}
+
+#endif	/* DER_ENCODE_ENABLE */
+
diff --git a/view/kernelcache/core/transformers/libDER/DER_Encode.h b/view/kernelcache/core/transformers/libDER/DER_Encode.h
new file mode 100644
index 00000000..6dc3d636
--- /dev/null
+++ b/view/kernelcache/core/transformers/libDER/DER_Encode.h
@@ -0,0 +1,124 @@
+/*
+ * Copyright (c) 2005-2007,2011,2013-2014 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ * 
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ * 
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+
+/*
+ * DER_Encode.h - DER encoding routines
+ *
+ */
+
+#ifndef	_DER_ENCODE_H_
+#define _DER_ENCODE_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <libDER/libDER.h>
+
+/*
+ * Max size of an encoded item given its length.
+ * This includes a possible leading zero prepended to a signed integer
+ * (see DER_ENC_SIGNED_INT below).
+ */
+#define DER_MAX_ENCODED_SIZE(len)					\
+	( 1 +			/* tag */						\
+	  5 +			/* max length */				\
+	  1 +			/* possible prepended zero */	\
+	  len)
+
+/* calculate size of encoded length */
+DERSize DERLengthOfLength(
+	DERSize length);
+
+/* encode length */
+DERReturn DEREncodeLength(
+	DERSize length,
+	DERByte *buf,		/* encoded length goes here */
+	DERSize *inOutLen);	/* IN/OUT */
+
+/* calculate size of encoded length */
+DERSize DERLengthOfItem(
+	DERTag tag,
+	DERSize length);
+
+/* encode item */
+DERReturn DEREncodeItem(
+	DERTag tag,
+	DERSize length,
+    const DERByte *src,
+	DERByte *derOut,	/* encoded item goes here */
+	DERSize *inOutLen);	/* IN/OUT */
+
+/*
+ * Per-item encode options.
+ */
+
+/* explicit default, no options */
+#define DER_ENC_NO_OPTS			0x0000
+
+/* signed integer check: if incoming m.s. bit is 1, prepend a zero */
+#define DER_ENC_SIGNED_INT		0x0100
+
+/* DERItem contains fully encoded item - copy, don't encode */
+#define DER_ENC_WRITE_DER		0x0200
+
+
+/*
+ * High-level sequence or set encode support.
+ *
+ * The outgoing sequence is expressed as an array of DERItemSpecs, each
+ * of which corresponds to one item in the encoded sequence.
+ *
+ * Normally the tag of the encoded item comes from the associated
+ * DERItemSpec, and the content comes from the DERItem whose address is
+ * the src arg plus the offset value in the associated DERItemSpec.
+ *
+ * If the DER_ENC_WRITE_DER option is true for a given DERItemSpec then
+ * no per-item encoding is done; the DER - with tag, length, and content -
+ * is taken en masse from the associated DERItem.
+ */
+DERReturn DEREncodeSequence(
+	DERTag				topTag,		/* ASN1_CONSTR_SEQUENCE, ASN1_CONSTR_SET */
+	const void			*src,		/* generally a ptr to a struct full of
+									 *    DERItems */
+	DERShort			numItems,	/* size of itemSpecs[] */
+	const DERItemSpec	*itemSpecs,
+	DERByte				*derOut,	/* encoded data written here */
+	DERSize				*inOutLen);	/* IN/OUT */
+
+/* precalculate the length of an encoded sequence. */
+DERSize DERLengthOfEncodedSequence(
+	DERTag				topTag,		/* ASN1_CONSTR_SEQUENCE, ASN1_CONSTR_SET */
+	const void			*src,		/* generally a ptr to a struct full of
+									 *    DERItems */
+	DERShort			numItems,	/* size of itemSpecs[] */
+	const DERItemSpec	*itemSpecs);
+
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* _DER_ENCODE_H_ */
+
diff --git a/view/kernelcache/core/transformers/libDER/LICENSE b/view/kernelcache/core/transformers/libDER/LICENSE
new file mode 100644
index 00000000..2116b0a8
--- /dev/null
+++ b/view/kernelcache/core/transformers/libDER/LICENSE
@@ -0,0 +1,60 @@
+APPLE PUBLIC SOURCE LICENSE
+Version 2.0 - August 6, 2003
+
+Please read this License carefully before downloading this software. By downloading or using this software, you are agreeing to be bound by the terms of this License. If you do not or cannot agree to the terms of this License, please do not download or use the software.
+
+Apple Note: In January 2007, Apple changed its corporate name from "Apple Computer, Inc." to "Apple Inc." This change has been reflected below and copyright years updated, but no other changes have been made to the APSL 2.0.
+
+    1. General; Definitions. This License applies to any program or other work which Apple Inc. ("Apple") makes publicly available and which contains a notice placed by Apple identifying such program or work as "Original Code" and stating that it is subject to the terms of this Apple Public Source License version 2.0 ("License"). As used in this License:
+        1.1 "Applicable Patent Rights" mean: (a) in the case where Apple is the grantor of rights, (i) claims of patents that are now or hereafter acquired, owned by or assigned to Apple and (ii) that cover subject matter contained in the Original Code, but only to the extent necessary to use, reproduce and/or distribute the Original Code without infringement; and (b) in the case where You are the grantor of rights, (i) claims of patents that are now or hereafter acquired, owned by or assigned to You and (ii) that cover subject matter in Your Modifications, taken alone or in combination with Original Code.
+        1.2 "Contributor" means any person or entity that creates or contributes to the creation of Modifications.
+        1.3 "Covered Code" means the Original Code, Modifications, the combination of Original Code and any Modifications, and/or any respective portions thereof.
+        1.4 "Externally Deploy" means: (a) to sublicense, distribute or otherwise make Covered Code available, directly or indirectly, to anyone other than You; and/or (b) to use Covered Code, alone or as part of a Larger Work, in any way to provide a service, including but not limited to delivery of content, through electronic communication with a client other than You.
+        1.5 "Larger Work" means a work which combines Covered Code or portions thereof with code not governed by the terms of this License.
+        1.6 "Modifications" mean any addition to, deletion from, and/or change to, the substance and/or structure of the Original Code, any previous Modifications, the combination of Original Code and any previous Modifications, and/or any respective portions thereof. When code is released as a series of files, a Modification is: (a) any addition to or deletion from the contents of a file containing Covered Code; and/or (b) any new file or other representation of computer program statements that contains any part of Covered Code.
+        1.7 "Original Code" means (a) the Source Code of a program or other work as originally made available by Apple under this License, including the Source Code of any updates or upgrades to such programs or works made available by Apple under this License, and that has been expressly identified by Apple as such in the header file(s) of such work; and (b) the object code compiled from such Source Code and originally made available by Apple under this License
+        1.8 "Source Code" means the human readable form of a program or other work that is suitable for making modifications to it, including all modules it contains, plus any associated interface definition files, scripts used to control compilation and installation of an executable (object code).
+        1.9 "You" or "Your" means an individual or a legal entity exercising rights under this License. For legal entities, "You" or "Your" includes any entity which controls, is controlled by, or is under common control with, You, where "control" means (a) the power, direct or indirect, to cause the direction or management of such entity, whether by contract or otherwise, or (b) ownership of fifty percent (50%) or more of the outstanding shares or beneficial ownership of such entity.
+    2. Permitted Uses; Conditions & Restrictions. Subject to the terms and conditions of this License, Apple hereby grants You, effective on the date You accept this License and download the Original Code, a world-wide, royalty-free, non-exclusive license, to the extent of Apple's Applicable Patent Rights and copyrights covering the Original Code, to do the following:
+        2.1 Unmodified Code. You may use, reproduce, display, perform, internally distribute within Your organization, and Externally Deploy verbatim, unmodified copies of the Original Code, for commercial or non-commercial purposes, provided that in each instance:
+            (a) You must retain and reproduce in all copies of Original Code the copyright and other proprietary notices and disclaimers of Apple as they appear in the Original Code, and keep intact all notices in the Original Code that refer to this License; and
+            (b) You must include a copy of this License with every copy of Source Code of Covered Code and documentation You distribute or Externally Deploy, and You may not offer or impose any terms on such Source Code that alter or restrict this License or the recipients' rights hereunder, except as permitted under Section 6.
+        2.2 Modified Code. You may modify Covered Code and use, reproduce, display, perform, internally distribute within Your organization, and Externally Deploy Your Modifications and Covered Code, for commercial or non-commercial purposes, provided that in each instance You also meet all of these conditions:
+            (a) You must satisfy all the conditions of Section 2.1 with respect to the Source Code of the Covered Code;
+            (b) You must duplicate, to the extent it does not already exist, the notice in Exhibit A in each file of the Source Code of all Your Modifications, and cause the modified files to carry prominent notices stating that You changed the files and the date of any change; and
+            (c) If You Externally Deploy Your Modifications, You must make Source Code of all Your Externally Deployed Modifications either available to those to whom You have Externally Deployed Your Modifications, or publicly available. Source Code of Your Externally Deployed Modifications must be released under the terms set forth in this License, including the license grants set forth in Section 3 below, for as long as you Externally Deploy the Covered Code or twelve (12) months from the date of initial External Deployment, whichever is longer. You should preferably distribute the Source Code of Your Externally Deployed Modifications electronically (e.g. download from a web site).
+        2.3 Distribution of Executable Versions. In addition, if You Externally Deploy Covered Code (Original Code and/or Modifications) in object code, executable form only, You must include a prominent notice, in the code itself as well as in related documentation, stating that Source Code of the Covered Code is available under the terms of this License with information on how and where to obtain such Source Code.
+        2.4 Third Party Rights. You expressly acknowledge and agree that although Apple and each Contributor grants the licenses to their respective portions of the Covered Code set forth herein, no assurances are provided by Apple or any Contributor that the Covered Code does not infringe the patent or other intellectual property rights of any other entity. Apple and each Contributor disclaim any liability to You for claims brought by any other entity based on infringement of intellectual property rights or otherwise. As a condition to exercising the rights and licenses granted hereunder, You hereby assume sole responsibility to secure any other intellectual property rights needed, if any. For example, if a third party patent license is required to allow You to distribute the Covered Code, it is Your responsibility to acquire that license before distributing the Covered Code.
+    3. Your Grants. In consideration of, and as a condition to, the licenses granted to You under this License, You hereby grant to any person or entity receiving or distributing Covered Code under this License a non-exclusive, royalty-free, perpetual, irrevocable license, under Your Applicable Patent Rights and other intellectual property rights (other than patent) owned or controlled by You, to use, reproduce, display, perform, modify, sublicense, distribute and Externally Deploy Your Modifications of the same scope and extent as Apple's licenses under Sections 2.1 and 2.2 above.
+    4. Larger Works. You may create a Larger Work by combining Covered Code with other code not governed by the terms of this License and distribute the Larger Work as a single product. In each such instance, You must make sure the requirements of this License are fulfilled for the Covered Code or any portion thereof.
+    5. Limitations on Patent License. Except as expressly stated in Section 2, no other patent rights, express or implied, are granted by Apple herein. Modifications and/or Larger Works may require additional patent licenses from Apple which Apple may grant in its sole discretion.
+    6. Additional Terms. You may choose to offer, and to charge a fee for, warranty, support, indemnity or liability obligations and/or other rights consistent with the scope of the license granted herein ("Additional Terms") to one or more recipients of Covered Code. However, You may do so only on Your own behalf and as Your sole responsibility, and not on behalf of Apple or any Contributor. You must obtain the recipient's agreement that any such Additional Terms are offered by You alone, and You hereby agree to indemnify, defend and hold Apple and every Contributor harmless for any liability incurred by or claims asserted against Apple or such Contributor by reason of any such Additional Terms.
+    7. Versions of the License. Apple may publish revised and/or new versions of this License from time to time. Each version will be given a distinguishing version number. Once Original Code has been published under a particular version of this License, You may continue to use it under the terms of that version. You may also choose to use such Original Code under the terms of any subsequent version of this License published by Apple. No one other than Apple has the right to modify the terms applicable to Covered Code created under this License.
+    8. NO WARRANTY OR SUPPORT. The Covered Code may contain in whole or in part pre-release, untested, or not fully tested works. The Covered Code may contain errors that could cause failures or loss of data, and may be incomplete or contain inaccuracies. You expressly acknowledge and agree that use of the Covered Code, or any portion thereof, is at Your sole and entire risk. THE COVERED CODE IS PROVIDED "AS IS" AND WITHOUT WARRANTY, UPGRADES OR SUPPORT OF ANY KIND AND APPLE AND APPLE'S LICENSOR(S) (COLLECTIVELY REFERRED TO AS "APPLE" FOR THE PURPOSES OF SECTIONS 8 AND 9) AND ALL CONTRIBUTORS EXPRESSLY DISCLAIM ALL WARRANTIES AND/OR CONDITIONS, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES AND/OR CONDITIONS OF MERCHANTABILITY, OF SATISFACTORY QUALITY, OF FITNESS FOR A PARTICULAR PURPOSE, OF ACCURACY, OF QUIET ENJOYMENT, AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. APPLE AND EACH CONTRIBUTOR DOES NOT WARRANT AGAINST INTERFERENCE WITH YOUR ENJOYMENT OF THE COVERED CODE, THAT THE FUNCTIONS CONTAINED IN THE COVERED CODE WILL MEET YOUR REQUIREMENTS, THAT THE OPERATION OF THE COVERED CODE WILL BE UNINTERRUPTED OR ERROR-FREE, OR THAT DEFECTS IN THE COVERED CODE WILL BE CORRECTED. NO ORAL OR WRITTEN INFORMATION OR ADVICE GIVEN BY APPLE, AN APPLE AUTHORIZED REPRESENTATIVE OR ANY CONTRIBUTOR SHALL CREATE A WARRANTY. You acknowledge that the Covered Code is not intended for use in the operation of nuclear facilities, aircraft navigation, communication systems, or air traffic control machines in which case the failure of the Covered Code could lead to death, personal injury, or severe physical or environmental damage.
+    9. LIMITATION OF LIABILITY. TO THE EXTENT NOT PROHIBITED BY LAW, IN NO EVENT SHALL APPLE OR ANY CONTRIBUTOR BE LIABLE FOR ANY INCIDENTAL, SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES ARISING OUT OF OR RELATING TO THIS LICENSE OR YOUR USE OR INABILITY TO USE THE COVERED CODE, OR ANY PORTION THEREOF, WHETHER UNDER A THEORY OF CONTRACT, WARRANTY, TORT (INCLUDING NEGLIGENCE), PRODUCTS LIABILITY OR OTHERWISE, EVEN IF APPLE OR SUCH CONTRIBUTOR HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES AND NOTWITHSTANDING THE FAILURE OF ESSENTIAL PURPOSE OF ANY REMEDY. SOME JURISDICTIONS DO NOT ALLOW THE LIMITATION OF LIABILITY OF INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THIS LIMITATION MAY NOT APPLY TO YOU. In no event shall Apple's total liability to You for all damages (other than as may be required by applicable law) under this License exceed the amount of fifty dollars ($50.00).
+    10. Trademarks. This License does not grant any rights to use the trademarks or trade names "Apple", "Mac", "Mac OS", "QuickTime", "QuickTime Streaming Server" or any other trademarks, service marks, logos or trade names belonging to Apple (collectively "Apple Marks") or to any trademark, service mark, logo or trade name belonging to any Contributor. You agree not to use any Apple Marks in or as part of the name of products derived from the Original Code or to endorse or promote products derived from the Original Code other than as expressly permitted by and in strict compliance at all times with Apple's third party trademark usage guidelines which are posted at http://www.apple.com/legal/guidelinesfor3rdparties.html.
+    11. Ownership. Subject to the licenses granted under this License, each Contributor retains all rights, title and interest in and to any Modifications made by such Contributor. Apple retains all rights, title and interest in and to the Original Code and any Modifications made by or on behalf of Apple ("Apple Modifications"), and such Apple Modifications will not be automatically subject to this License. Apple may, at its sole discretion, choose to license such Apple Modifications under this License, or on different terms from those contained in this License or may choose not to license them at all.
+    12. Termination.
+        12.1 Termination. This License and the rights granted hereunder will terminate:
+            (a) automatically without notice from Apple if You fail to comply with any term(s) of this License and fail to cure such breach within 30 days of becoming aware of such breach;
+            (b) immediately in the event of the circumstances described in Section 13.5(b); or
+            (c) automatically without notice from Apple if You, at any time during the term of this License, commence an action for patent infringement against Apple; provided that Apple did not first commence an action for patent infringement against You in that instance.
+        12.2 Effect of Termination. Upon termination, You agree to immediately stop any further use, reproduction, modification, sublicensing and distribution of the Covered Code. All sublicenses to the Covered Code which have been properly granted prior to termination shall survive any termination of this License. Provisions which, by their nature, should remain in effect beyond the termination of this License shall survive, including but not limited to Sections 3, 5, 8, 9, 10, 11, 12.2 and 13. No party will be liable to any other for compensation, indemnity or damages of any sort solely as a result of terminating this License in accordance with its terms, and termination of this License will be without prejudice to any other right or remedy of any party.
+    13. Miscellaneous.
+        13.1 Government End Users. The Covered Code is a "commercial item" as defined in FAR 2.101. Government software and technical data rights in the Covered Code include only those rights customarily provided to the public as defined in this License. This customary commercial license in technical data and software is provided in accordance with FAR 12.211 (Technical Data) and 12.212 (Computer Software) and, for Department of Defense purchases, DFAR 252.227-7015 (Technical Data -- Commercial Items) and 227.7202-3 (Rights in Commercial Computer Software or Computer Software Documentation). Accordingly, all U.S. Government End Users acquire Covered Code with only those rights set forth herein.
+        13.2 Relationship of Parties. This License will not be construed as creating an agency, partnership, joint venture or any other form of legal association between or among You, Apple or any Contributor, and You will not represent to the contrary, whether expressly, by implication, appearance or otherwise.
+        13.3 Independent Development. Nothing in this License will impair Apple's right to acquire, license, develop, have others develop for it, market and/or distribute technology or products that perform the same or similar functions as, or otherwise compete with, Modifications, Larger Works, technology or products that You may develop, produce, market or distribute.
+        13.4 Waiver; Construction. Failure by Apple or any Contributor to enforce any provision of this License will not be deemed a waiver of future enforcement of that or any other provision. Any law or regulation which provides that the language of a contract shall be construed against the drafter will not apply to this License.
+        13.5 Severability. (a) If for any reason a court of competent jurisdiction finds any provision of this License, or portion thereof, to be unenforceable, that provision of the License will be enforced to the maximum extent permissible so as to effect the economic benefits and intent of the parties, and the remainder of this License will continue in full force and effect. (b) Notwithstanding the foregoing, if applicable law prohibits or restricts You from fully and/or specifically complying with Sections 2 and/or 3 or prevents the enforceability of either of those Sections, this License will immediately terminate and You must immediately discontinue any use of the Covered Code and destroy all copies of it that are in your possession or control.
+        13.6 Dispute Resolution. Any litigation or other dispute resolution between You and Apple relating to this License shall take place in the Northern District of California, and You and Apple hereby consent to the personal jurisdiction of, and venue in, the state and federal courts within that District with respect to this License. The application of the United Nations Convention on Contracts for the International Sale of Goods is expressly excluded.
+        13.7 Entire Agreement; Governing Law. This License constitutes the entire agreement between the parties with respect to the subject matter hereof. This License shall be governed by the laws of the United States and the State of California, except that body of California law concerning conflicts of law.
+
+        Where You are located in the province of Quebec, Canada, the following clause applies: The parties hereby confirm that they have requested that this License and all related documents be drafted in English. Les parties ont exigé que le présent contrat et tous les documents connexes soient rédigés en anglais.
+
+EXHIBIT A.
+
+"Portions Copyright (c) 1999-2007 Apple Inc. All Rights Reserved.
+
+This file contains Original Code and/or Modifications of Original Code as defined in and that are subject to the Apple Public Source License Version 2.0 (the 'License'). You may not use this file except in compliance with the License. Please obtain a copy of the License at http://www.opensource.apple.com/apsl/ and read it before using this file.
+
+The Original Code and all software distributed under the License are distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. Please see the License for the specific language governing rights and limitations under the License."
diff --git a/view/kernelcache/core/transformers/libDER/asn1Types.h b/view/kernelcache/core/transformers/libDER/asn1Types.h
new file mode 100644
index 00000000..5275af3c
--- /dev/null
+++ b/view/kernelcache/core/transformers/libDER/asn1Types.h
@@ -0,0 +1,112 @@
+/*
+ * Copyright (c) 2005-2007,2011,2014 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ * 
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ * 
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+
+/*
+ * asn1Types.h - ASN.1/DER #defines - strictly hard coded per the real world
+ *
+ */
+ 
+#ifndef	_ASN1_TYPES_H_
+#define _ASN1_TYPES_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* copied from libsecurity_asn1 project */
+
+#define ASN1_BOOLEAN			0x01
+#define ASN1_INTEGER			0x02
+#define ASN1_BIT_STRING			0x03
+#define ASN1_OCTET_STRING		0x04
+#define ASN1_NULL				0x05
+#define ASN1_OBJECT_ID			0x06
+#define ASN1_OBJECT_DESCRIPTOR  0x07
+/* External type and instance-of type   0x08 */
+#define ASN1_REAL               0x09
+#define ASN1_ENUMERATED			0x0a
+#define ASN1_EMBEDDED_PDV       0x0b
+#define ASN1_UTF8_STRING		0x0c
+/*                                  0x0d */
+/*                                  0x0e */
+/*                                  0x0f */
+#define ASN1_SEQUENCE			0x10
+#define ASN1_SET				0x11
+#define ASN1_NUMERIC_STRING		0x12
+#define ASN1_PRINTABLE_STRING	0x13
+#define ASN1_T61_STRING			0x14
+#define ASN1_VIDEOTEX_STRING	0x15
+#define ASN1_IA5_STRING			0x16
+#define ASN1_UTC_TIME			0x17
+#define ASN1_GENERALIZED_TIME	0x18
+#define ASN1_GRAPHIC_STRING		0x19
+#define ASN1_VISIBLE_STRING		0x1a
+#define ASN1_GENERAL_STRING		0x1b
+#define ASN1_UNIVERSAL_STRING	0x1c
+/*                                  0x1d */
+#define ASN1_BMP_STRING			0x1e
+#define ASN1_HIGH_TAG_NUMBER	0x1f
+#define ASN1_TELETEX_STRING ASN1_T61_STRING
+
+#ifdef DER_MULTIBYTE_TAGS
+
+#define ASN1_TAG_MASK			((DERTag)~0)
+#define ASN1_TAGNUM_MASK        ((DERTag)~((DERTag)7 << (sizeof(DERTag) * 8 - 3)))
+
+#define ASN1_METHOD_MASK		((DERTag)1 << (sizeof(DERTag) * 8 - 3))
+#define ASN1_PRIMITIVE			((DERTag)0 << (sizeof(DERTag) * 8 - 3))
+#define ASN1_CONSTRUCTED		((DERTag)1 << (sizeof(DERTag) * 8 - 3))
+
+#define ASN1_CLASS_MASK			((DERTag)3 << (sizeof(DERTag) * 8 - 2))
+#define ASN1_UNIVERSAL			((DERTag)0 << (sizeof(DERTag) * 8 - 2))
+#define ASN1_APPLICATION		((DERTag)1 << (sizeof(DERTag) * 8 - 2))
+#define ASN1_CONTEXT_SPECIFIC	((DERTag)2 << (sizeof(DERTag) * 8 - 2))
+#define ASN1_PRIVATE			((DERTag)3 << (sizeof(DERTag) * 8 - 2))
+
+#else /* DER_MULTIBYTE_TAGS */
+
+#define ASN1_TAG_MASK			0xff
+#define ASN1_TAGNUM_MASK		0x1f
+#define ASN1_METHOD_MASK		0x20
+#define ASN1_PRIMITIVE			0x00
+#define ASN1_CONSTRUCTED		0x20
+
+#define ASN1_CLASS_MASK			0xc0
+#define ASN1_UNIVERSAL			0x00
+#define ASN1_APPLICATION		0x40
+#define ASN1_CONTEXT_SPECIFIC	0x80
+#define ASN1_PRIVATE			0xc0
+
+#endif /* !DER_MULTIBYTE_TAGS */
+
+/* sequence and set appear as the following */
+#define ASN1_CONSTR_SEQUENCE	(ASN1_CONSTRUCTED | ASN1_SEQUENCE)
+#define ASN1_CONSTR_SET			(ASN1_CONSTRUCTED | ASN1_SET)
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* _ASN1_TYPES_H_ */
+
diff --git a/view/kernelcache/core/transformers/libDER/libDER.h b/view/kernelcache/core/transformers/libDER/libDER.h
new file mode 100644
index 00000000..cde53fe5
--- /dev/null
+++ b/view/kernelcache/core/transformers/libDER/libDER.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (c) 2005-2007,2011,2014 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ * 
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ * 
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+
+/*
+ * libDER.h - main header for libDER, a ROM-capable DER decoding library. 
+ *
+ */
+ 
+#ifndef	_LIB_DER_H_
+#define _LIB_DER_H_
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+#include <libDER/libDER_config.h>
+/*
+ * Error returns generated by this library.
+ */
+typedef enum {
+	DR_Success,
+	DR_EndOfSequence,	/* end of sequence or set */
+	DR_UnexpectedTag,	/* unexpected tag found while decoding */
+	DR_DecodeError,		/* misc. decoding error (badly formatted DER) */
+	DR_Unimplemented,	/* function not implemented in this configuration */
+	DR_IncompleteSeq,	/* incomplete sequence */
+	DR_ParamErr,		/* incoming parameter error */
+	DR_BufOverflow		/* buffer overflow */
+	/* etc. */
+} DERReturn;
+
+/* 
+ * Primary representation of a block of memory.
+ */
+typedef struct {
+	DERByte		*data;
+	DERSize		length;
+} DERItem;
+
+/* 
+ * The structure of a sequence during decode or encode is expressed as 
+ * an array of DERItemSpecs. While decoding or encoding a sequence, 
+ * each item in the sequence corresponds to one DERItemSpec.
+ */
+typedef struct {
+	DERSize			offset;			/* offset of destination DERItem */
+	DERTag			tag;			/* DER tag */
+	DERShort		options;		/* DER_DEC_xxx or DER_ENC_xxx */
+} DERItemSpec;
+
+/*
+ * Macro to obtain offset of a DERDecodedInfo within a struct.
+ * FIXME this is going to need reworking to avoid compiler warnings
+ * on 64-bit compiles. It'll work OK as long as an offset can't be larger
+ * than a DERSize, but the cast from a pointer to a DERSize may 
+ * provoke compiler warnings. 
+ */
+#define DER_OFFSET(type, field) ((DERSize)(&((type *)0)->field))
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* _LIB_DER_H_ */
+
diff --git a/view/kernelcache/core/transformers/libDER/libDER_config.h b/view/kernelcache/core/transformers/libDER/libDER_config.h
new file mode 100644
index 00000000..08fe40da
--- /dev/null
+++ b/view/kernelcache/core/transformers/libDER/libDER_config.h
@@ -0,0 +1,113 @@
+/*
+ * Copyright (c) 2005-2007,2011-2012,2014 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ * 
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ * 
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+
+/*
+ * libDER_config.h - platform dependent #defines and typedefs for libDER
+ *
+ */
+ 
+#ifndef	_LIB_DER_CONFIG_H_
+#define _LIB_DER_CONFIG_H_
+
+#include <stdint.h>
+#include <string.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/*
+ * Basic data types: unsigned 8-bit integer, unsigned 32-bit integer
+ */
+typedef uint8_t DERByte;
+typedef uint16_t DERShort;
+typedef uint32_t DERSize;
+
+/* 
+ * Use these #defines of you have memset, memmove, and memcmp; else
+ * write your own equivalents.
+ */
+
+#define DERMemset(ptr, c, len)		memset(ptr, c, len)
+#define DERMemmove(dst, src, len)	memmove(dst, src, len)
+#define DERMemcmp(b1, b2, len)		memcmp(b1, b2, len)
+
+
+/***
+ *** Compile time options to trim size of the library. 
+ ***/
+ 
+/* enable general DER encode */
+#define DER_ENCODE_ENABLE		1
+
+/* enable general DER decode */
+#define DER_DECODE_ENABLE		1
+
+#ifndef DER_MULTIBYTE_TAGS
+/* enable multibyte tag support. */
+#define DER_MULTIBYTE_TAGS		1
+#endif
+
+#ifndef DER_TAG_SIZE
+/* Iff DER_MULTIBYTE_TAGS is 1 this is the sizeof(DERTag) in bytes. Note that
+   tags are still encoded and decoded from a minimally encoded DER
+   represantation.  This value determines how big each DERItemSpecs is, we
+   choose 2 since that makes DERItemSpecs 8 bytes wide.  */
+#define DER_TAG_SIZE            8
+#endif
+
+
+/* ---------------------- Do not edit below this line ---------------------- */
+
+/*
+ * Logical representation of a tag (the encoded representation is always in
+ * the minimal number of bytes). The top 3 bits encode class and method
+ * The remaining bits encode the tag value.  To obtain smaller DERItemSpecs
+ * sizes, choose the smallest type that fits your needs.  Most standard ASN.1
+ * usage only needs single byte tags, but ocasionally custom applications
+ * require a larger tag namespace.
+ */
+#if DER_MULTIBYTE_TAGS
+
+#if DER_TAG_SIZE == 1
+typedef uint8_t DERTag;
+#elif DER_TAG_SIZE == 2
+typedef uint16_t DERTag;
+#elif DER_TAG_SIZE == 4
+typedef uint32_t DERTag;
+#elif DER_TAG_SIZE == 8
+typedef uint64_t DERTag;
+#else
+#error DER_TAG_SIZE invalid
+#endif
+
+#else /* DER_MULTIBYTE_TAGS */
+typedef DERByte DERTag;
+#endif /* !DER_MULTIBYTE_TAGS */
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* _LIB_DER_CONFIG_H_ */
diff --git a/view/kernelcache/core/transformers/libDER/oids.c b/view/kernelcache/core/transformers/libDER/oids.c
new file mode 100644
index 00000000..444457c5
--- /dev/null
+++ b/view/kernelcache/core/transformers/libDER/oids.c
@@ -0,0 +1,576 @@
+/*
+ * Copyright (c) 2005-2009,2011-2014 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ * 
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ * 
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+
+/*
+ * oids.c - OID consts
+ *
+ */
+
+#include <libDER/libDER.h>
+#include <libDER/oids.h>
+
+#define OID_ISO_CCITT_DIR_SERVICE 			85
+#define OID_DS              				OID_ISO_CCITT_DIR_SERVICE
+#define OID_ATTR_TYPE        				OID_DS, 4
+#define OID_EXTENSION        				OID_DS, 29
+#define OID_ISO_STANDARD      	 			40
+#define OID_ISO_MEMBER         				42
+#define OID_US                 				OID_ISO_MEMBER, 134, 72
+
+#define OID_ISO_IDENTIFIED_ORG 				43
+#define OID_OSINET             				OID_ISO_IDENTIFIED_ORG, 4
+#define OID_GOSIP              				OID_ISO_IDENTIFIED_ORG, 5
+#define OID_DOD                				OID_ISO_IDENTIFIED_ORG, 6
+#define OID_OIW                				OID_ISO_IDENTIFIED_ORG, 14
+
+/* From the PKCS Standards */
+#define OID_RSA               				OID_US, 134, 247, 13
+#define OID_RSA_HASH          				OID_RSA, 2
+#define OID_RSA_ENCRYPT       				OID_RSA, 3
+#define OID_PKCS             				OID_RSA, 1
+#define OID_PKCS_1          				OID_PKCS, 1
+#define OID_PKCS_2          				OID_PKCS, 2
+#define OID_PKCS_3          				OID_PKCS, 3
+#define OID_PKCS_4          				OID_PKCS, 4
+#define OID_PKCS_5          				OID_PKCS, 5
+#define OID_PKCS_6          				OID_PKCS, 6
+#define OID_PKCS_7          				OID_PKCS, 7
+#define OID_PKCS_8          				OID_PKCS, 8
+#define OID_PKCS_9          				OID_PKCS, 9
+#define OID_PKCS_10         				OID_PKCS, 10
+#define OID_PKCS_11          				OID_PKCS, 11
+#define OID_PKCS_12          				OID_PKCS, 12
+
+/* ANSI X9.62 */
+#define OID_ANSI_X9_62						OID_US, 206, 61
+#define OID_PUBLIC_KEY_TYPE					OID_ANSI_X9_62, 2
+#define OID_EC_SIG_TYPE                     OID_ANSI_X9_62, 4
+#define OID_ECDSA_WITH_SHA2                 OID_EC_SIG_TYPE, 3
+
+/* ANSI X9.42 */
+#define OID_ANSI_X9_42						OID_US, 206, 62, 2
+#define OID_ANSI_X9_42_SCHEME				OID_ANSI_X9_42, 3
+#define OID_ANSI_X9_42_NAMED_SCHEME			OID_ANSI_X9_42, 4
+
+/* DOD IANA Security releated objects. */
+#define OID_IANA                            OID_DOD, 1, 5
+
+/* Kerberos PKINIT */
+#define OID_KERBv5							OID_IANA, 2
+#define OID_KERBv5_PKINIT					OID_KERBv5, 3
+
+/* DOD IANA Mechanisms. */
+#define OID_MECHANISMS						OID_IANA, 5
+
+/* PKIX */
+#define OID_PKIX							OID_MECHANISMS, 7
+#define OID_PE								OID_PKIX, 1
+#define OID_QT								OID_PKIX, 2
+#define OID_KP								OID_PKIX, 3
+#define OID_OTHER_NAME						OID_PKIX, 8
+#define OID_PDA								OID_PKIX, 9
+#define OID_QCS								OID_PKIX, 11
+#define OID_AD								OID_PKIX, 48
+#define OID_AD_OCSP							OID_AD, 1
+#define OID_AD_CAISSUERS                    OID_AD, 2
+
+/* ISAKMP */
+#define OID_ISAKMP							OID_MECHANISMS, 8
+
+/* ETSI */
+#define OID_ETSI							0x04, 0x00
+#define OID_ETSI_QCS						0x04, 0x00, 0x8E, 0x46, 0x01
+
+#define OID_OIW_SECSIG        				OID_OIW, 3
+
+#define OID_OIW_ALGORITHM    				OID_OIW_SECSIG, 2
+
+/* NIST defined digest algorithm arc (2, 16, 840, 1, 101, 3, 4, 2) */
+#define OID_NIST_HASHALG					0x60, 0x86, 0x48, 0x01, 0x65, 0x03, 0x04, 0x02
+
+/*
+ * Apple-specific OID bases
+ */
+
+/*
+ * apple OBJECT IDENTIFIER ::=
+ * 	{ iso(1) member-body(2) US(840) 113635 }
+ *
+ * BER = 06 06 2A 86 48 86 F7 63
+ */
+#define APPLE_OID				OID_US, 0x86, 0xf7, 0x63
+
+/* appleDataSecurity OBJECT IDENTIFIER ::=
+ *		{ apple 100 }
+ *      { 1 2 840 113635 100 }
+ *
+ * BER = 06 07 2A 86 48 86 F7 63 64
+ */
+#define APPLE_ADS_OID			APPLE_OID, 0x64
+
+/*
+ * appleTrustPolicy OBJECT IDENTIFIER ::=
+ *		{ appleDataSecurity 1 }
+ *      { 1 2 840 113635 100 1 }
+ *
+ * BER = 06 08 2A 86 48 86 F7 63 64 01
+ */
+#define APPLE_TP_OID			APPLE_ADS_OID, 1
+
+/*
+ *	appleSecurityAlgorithm OBJECT IDENTIFIER ::=
+ *		{ appleDataSecurity 2 }
+ *      { 1 2 840 113635 100 2 }
+ *
+ * BER = 06 08 2A 86 48 86 F7 63 64 02
+ */
+#define APPLE_ALG_OID			APPLE_ADS_OID, 2
+
+/*
+ * appleDotMacCertificate OBJECT IDENTIFIER ::=
+ *		{ appleDataSecurity 3 }
+ *      { 1 2 840 113635 100 3 }
+ */
+#define APPLE_DOTMAC_CERT_OID			APPLE_ADS_OID, 3
+
+/*
+ * Basis of Policy OIDs for .mac TP requests
+ *
+ * dotMacCertificateRequest OBJECT IDENTIFIER ::=
+ *		{ appleDotMacCertificate 1 }
+ *      { 1 2 840 113635 100 3 1 }
+ */
+#define APPLE_DOTMAC_CERT_REQ_OID			APPLE_DOTMAC_CERT_OID, 1
+
+/*
+ * Basis of .mac Certificate Extensions
+ *
+ * dotMacCertificateExtension OBJECT IDENTIFIER ::=
+ *		{ appleDotMacCertificate 2 }
+ *      { 1 2 840 113635 100 3 2 }
+ */
+#define APPLE_DOTMAC_CERT_EXTEN_OID			APPLE_DOTMAC_CERT_OID, 2
+
+/*
+ * Basis of .mac Certificate request OID/value identitifiers
+ *
+ * dotMacCertificateRequestValues OBJECT IDENTIFIER ::=
+ *		{ appleDotMacCertificate 3 }
+ *      { 1 2 840 113635 100 3 3 }
+ */
+#define APPLE_DOTMAC_CERT_REQ_VALUE_OID			APPLE_DOTMAC_CERT_OID, 3
+
+/*
+ * Basis of Apple-specific extended key usages
+ *
+ * appleExtendedKeyUsage OBJECT IDENTIFIER ::=
+ *		{ appleDataSecurity 4 }
+ *      { 1 2 840 113635 100 4 }
+ */
+#define APPLE_EKU_OID					APPLE_ADS_OID, 4
+
+/*
+ * Basis of Apple Code Signing extended key usages
+ * appleCodeSigning  OBJECT IDENTIFIER ::=
+ *		{ appleExtendedKeyUsage 1 }
+ *      { 1 2 840 113635 100 4 1}
+ */
+#define APPLE_EKU_CODE_SIGNING			APPLE_EKU_OID, 1
+#define APPLE_EKU_APPLE_ID              APPLE_EKU_OID, 7
+#define APPLE_EKU_SHOEBOX               APPLE_EKU_OID, 14
+#define APPLE_EKU_PROFILE_SIGNING       APPLE_EKU_OID, 16
+#define APPLE_EKU_QA_PROFILE_SIGNING    APPLE_EKU_OID, 17
+
+
+/*
+ * Basis of Apple-specific Certificate Policy IDs.
+ * appleCertificatePolicies OBJECT IDENTIFIER ::=
+ *		{ appleDataSecurity 5 }
+ *		{ 1 2 840 113635 100 5 }
+ */
+#define APPLE_CERT_POLICIES				APPLE_ADS_OID, 5
+
+#define APPLE_CERT_POLICY_MOBILE_STORE	APPLE_CERT_POLICIES, 12
+
+#define APPLE_CERT_POLICY_TEST_MOBILE_STORE APPLE_CERT_POLICY_MOBILE_STORE, 1
+
+/*
+ * Basis of Apple-specific Signing extensions
+ *		{ appleDataSecurity 6 }
+ */
+#define APPLE_CERT_EXT    APPLE_ADS_OID, 6
+
+/* Apple Intermediate Marker OIDs */
+#define APPLE_CERT_EXT_INTERMEDIATE_MARKER APPLE_CERT_EXT, 2
+/* Apple Apple ID Intermediate Marker */
+#define APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLEID APPLE_CERT_EXT_INTERMEDIATE_MARKER, 3
+/*
+ *  Apple Apple ID Intermediate Marker (New subCA, no longer shared with push notification server cert issuer
+ *
+ *  appleCertificateExtensionAppleIDIntermediate ::=
+ *    { appleCertificateExtensionIntermediateMarker 7 }
+ *    { 1 2 840 113635 100 6 2 7 }
+ */
+#define APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLEID_2 APPLE_CERT_EXT_INTERMEDIATE_MARKER, 7
+
+#define APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLEID_SYSTEM_INTEGRATION_2 APPLE_CERT_EXT_INTERMEDIATE_MARKER, 10
+
+#define APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLEID_SYSTEM_INTEGRATION_G3 APPLE_CERT_EXT_INTERMEDIATE_MARKER, 13
+
+#define APPLE_CERT_EXT_APPLE_PUSH_MARKER    APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLEID, 2
+
+
+#define APPLE_CERT_EXTENSION_CODESIGNING        APPLE_CERT_EXT, 1
+
+/* Secure Boot Embedded Image3 value,
+   co-opted by desktop for "Apple Released Code Signature", without value */
+#define APPLE_SBOOT_CERT_EXTEN_SBOOT_SPEC_OID	APPLE_CERT_EXTENSION_CODESIGNING, 1
+/* iPhone Provisioning Profile Signing leaf - on the intermediate marker arc? */
+#define APPLE_PROVISIONING_PROFILE_OID	APPLE_CERT_EXT_INTERMEDIATE_MARKER, 1
+/* iPhone Application Signing leaf */
+#define APPLE_APP_SIGNING_OID          APPLE_CERT_EXTENSION_CODESIGNING, 3
+
+#define APPLE_INSTALLER_PACKAGE_SIGNING_EXTERNAL_OID       APPLE_CERT_EXTENSION_CODESIGNING, 16
+
+#define APPLE_ESCROW_ARC APPLE_CERT_EXT, 23
+
+#define APPLE_ESCROW_POLICY_OID APPLE_ESCROW_ARC, 1
+
+#define APPLE_CERT_EXT_APPLE_ID_VALIDATION_RECORD_SIGNING	APPLE_CERT_EXT, 25
+
+#define APPLE_SERVER_AUTHENTICATION                    APPLE_CERT_EXT, 27
+#define APPLE_CERT_EXT_APPLE_SERVER_AUTHENTICATION     APPLE_SERVER_AUTHENTICATION, 1
+#define APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLE_SERVER_AUTHENTICATION APPLE_CERT_EXT_INTERMEDIATE_MARKER, 12
+
+#define APPLE_CERT_EXT_APPLE_SMP_ENCRYPTION    APPLE_CERT_EXT, 30
+
+/*
+ * Netscape OIDs.
+ */
+#define NETSCAPE_BASE_OID           0x60, 0x86, 0x48, 0x01, 0x86, 0xf8, 0x42
+
+/*
+ * Netscape cert extension.
+ *
+ *  netscape-cert-extension OBJECT IDENTIFIER ::=
+ * 		{ 2 16 840 1 113730 1 }
+ *
+ *	BER = 06 08 60 86 48 01 86 F8 42 01
+ */
+#define NETSCAPE_CERT_EXTEN			NETSCAPE_BASE_OID, 0x01
+
+#define NETSCAPE_CERT_POLICY		NETSCAPE_BASE_OID, 0x04
+
+/* Entrust OIDs. */
+#define ENTRUST_BASE_OID            OID_US, 0x86, 0xf6, 0x7d
+
+/*
+ * Entrust cert extension.
+ *
+ *  entrust-cert-extension OBJECT IDENTIFIER ::=
+ * 		{  1 2 840 113533 7 65 }
+ *
+ *	BER = 06 08 2A 86 48 86 F6 7D 07 41
+ */
+#define ENTRUST_CERT_EXTEN			ENTRUST_BASE_OID, 0x07, 0x41
+
+/* Microsfot OIDs. */
+#define MICROSOFT_BASE_OID          OID_DOD, 0x01, 0x04, 0x01, 0x82, 0x37
+#define MICROSOFT_ENROLLMENT_OID    MICROSOFT_BASE_OID, 0x14
+
+/* Algorithm OIDs. */
+static const DERByte
+    _oidRsa[]                       = { OID_PKCS_1, 1 },
+    _oidMd2Rsa[]                    = { OID_PKCS_1, 2 },
+    _oidMd5Rsa[]                    = { OID_PKCS_1, 4 },
+    _oidSha1Rsa[]                   = { OID_PKCS_1, 5 },
+    _oidSha256Rsa[]                 = { OID_PKCS_1, 11 },
+    _oidEcPubKey[]                  = { OID_PUBLIC_KEY_TYPE, 1 },
+    _oidSha1Ecdsa[]                 = { OID_EC_SIG_TYPE, 1 },     /* rfc3279 */
+    _oidSha224Ecdsa[]               = { OID_ECDSA_WITH_SHA2, 1 }, /* rfc5758 */
+    _oidSha256Ecdsa[]               = { OID_ECDSA_WITH_SHA2, 2 }, /* rfc5758 */
+    _oidSha384Ecdsa[]               = { OID_ECDSA_WITH_SHA2, 3 }, /* rfc5758 */
+    _oidSha512Ecdsa[]               = { OID_ECDSA_WITH_SHA2, 4 }, /* rfc5758 */
+    _oidMd2[]                       = { OID_RSA_HASH, 2 },
+    _oidMd4[]                       = { OID_RSA_HASH, 4 },
+    _oidMd5[]                       = { OID_RSA_HASH, 5 },
+    _oidSha1[]                      = { OID_OIW_ALGORITHM, 26 },
+    _oidSha256[]                    = { OID_NIST_HASHALG, 1 },
+    _oidSha384[]                    = { OID_NIST_HASHALG, 2 },
+    _oidSha512[]                    = { OID_NIST_HASHALG, 3 },
+    _oidSha224[]                    = { OID_NIST_HASHALG, 4 };
+
+const DERItem
+    oidRsa                          = { (DERByte *)_oidRsa,
+                                        sizeof(_oidRsa) },
+    oidMd2Rsa                       = { (DERByte *)_oidMd2Rsa,
+                                        sizeof(_oidMd2Rsa) },
+    oidMd5Rsa                       = { (DERByte *)_oidMd5Rsa,
+                                        sizeof(_oidMd5Rsa) },
+    oidSha1Rsa                      = { (DERByte *)_oidSha1Rsa,
+                                        sizeof(_oidSha1Rsa) },
+    oidSha256Rsa                    = { (DERByte *)_oidSha256Rsa,
+                                        sizeof(_oidSha256Rsa) },
+    oidEcPubKey                     = { (DERByte *)_oidEcPubKey,
+                                        sizeof(_oidEcPubKey) },
+    oidSha1Ecdsa                    = { (DERByte *)_oidSha1Ecdsa,
+                                        sizeof(_oidSha1Ecdsa) },
+    oidSha224Ecdsa                    = { (DERByte *)_oidSha224Ecdsa,
+                                        sizeof(_oidSha224Ecdsa) },
+    oidSha256Ecdsa                    = { (DERByte *)_oidSha256Ecdsa,
+                                        sizeof(_oidSha256Ecdsa) },
+    oidSha384Ecdsa                    = { (DERByte *)_oidSha384Ecdsa,
+                                        sizeof(_oidSha384Ecdsa) },
+    oidSha512Ecdsa                    = { (DERByte *)_oidSha512Ecdsa,
+                                        sizeof(_oidSha512Ecdsa) },
+    oidMd2                          = { (DERByte *)_oidMd2,
+                                        sizeof(_oidMd2) },
+    oidMd4                          = { (DERByte *)_oidMd4,
+                                        sizeof(_oidMd4) },
+    oidMd5                          = { (DERByte *)_oidMd5,
+                                        sizeof(_oidMd5) },
+    oidSha1                         = { (DERByte *)_oidSha1,
+                                        sizeof(_oidSha1) },
+    oidSha256                       = { (DERByte *)_oidSha256,
+                                        sizeof(_oidSha256) },
+    oidSha384                       = { (DERByte *)_oidSha384,
+                                        sizeof(_oidSha384) },
+    oidSha512                       = { (DERByte *)_oidSha512,
+                                        sizeof(_oidSha512) },
+    oidSha224                       = { (DERByte *)_oidSha224,
+                                        sizeof(_oidSha224) };
+
+/* Extension OIDs. */
+static const DERByte
+    _oidSubjectKeyIdentifier[]      = { OID_EXTENSION, 14 },
+    _oidKeyUsage[]                  = { OID_EXTENSION, 15 },
+    _oidPrivateKeyUsagePeriod[]     = { OID_EXTENSION, 16 },
+    _oidSubjectAltName[]            = { OID_EXTENSION, 17 },
+    _oidIssuerAltName[]             = { OID_EXTENSION, 18 },
+    _oidBasicConstraints[]          = { OID_EXTENSION, 19 },
+    _oidCrlDistributionPoints[]     = { OID_EXTENSION, 31 },
+    _oidCertificatePolicies[]       = { OID_EXTENSION, 32 },
+    _oidAnyPolicy[]                 = { OID_EXTENSION, 32, 0 },
+    _oidPolicyMappings[]            = { OID_EXTENSION, 33 },
+    _oidAuthorityKeyIdentifier[]    = { OID_EXTENSION, 35 },
+    _oidPolicyConstraints[]         = { OID_EXTENSION, 36 },
+    _oidExtendedKeyUsage[]          = { OID_EXTENSION, 37 },
+    _oidAnyExtendedKeyUsage[]          = { OID_EXTENSION, 37, 0 },
+    _oidInhibitAnyPolicy[]          = { OID_EXTENSION, 54 },
+    _oidAuthorityInfoAccess[]       = { OID_PE, 1 },
+    _oidSubjectInfoAccess[]         = { OID_PE, 11 },
+    _oidAdOCSP[]                    = { OID_AD_OCSP },
+    _oidAdCAIssuer[]                = { OID_AD_CAISSUERS },
+    _oidNetscapeCertType[]          = { NETSCAPE_CERT_EXTEN, 1 },
+    _oidEntrustVersInfo[]           = { ENTRUST_CERT_EXTEN, 0 },
+    _oidMSNTPrincipalName[]         = { MICROSOFT_ENROLLMENT_OID, 2, 3 },
+    /* Policy Qualifier IDs for Internet policy qualifiers. */
+    _oidQtCps[]                     = { OID_QT, 1 },
+    _oidQtUNotice[]                 = { OID_QT, 2 },
+    /* X.501 Name IDs. */
+    _oidCommonName[]                = { OID_ATTR_TYPE, 3 },
+    _oidCountryName[]               = { OID_ATTR_TYPE, 6 },
+    _oidLocalityName[]              = { OID_ATTR_TYPE, 7 },
+    _oidStateOrProvinceName[]       = { OID_ATTR_TYPE, 8 },
+    _oidOrganizationName[]          = { OID_ATTR_TYPE, 10 },
+    _oidOrganizationalUnitName[]    = { OID_ATTR_TYPE, 11 },
+    _oidDescription[]               = { OID_ATTR_TYPE, 13 },
+    _oidEmailAddress[]              = { OID_PKCS_9, 1 },
+    _oidFriendlyName[]              = { OID_PKCS_9, 20 },
+    _oidLocalKeyId[]                = { OID_PKCS_9, 21 },
+    _oidExtendedKeyUsageServerAuth[] = { OID_KP, 1 },
+    _oidExtendedKeyUsageClientAuth[] = { OID_KP, 2 },
+    _oidExtendedKeyUsageCodeSigning[] = { OID_KP, 3 },
+    _oidExtendedKeyUsageEmailProtection[] = { OID_KP, 4 },
+    _oidExtendedKeyUsageOCSPSigning[] = { OID_KP, 9 },
+    _oidExtendedKeyUsageIPSec[]     = { OID_ISAKMP, 2, 2 },
+    _oidExtendedKeyUsageMicrosoftSGC[] = { MICROSOFT_BASE_OID, 10, 3, 3 },
+    _oidExtendedKeyUsageNetscapeSGC[] = { NETSCAPE_CERT_POLICY, 1 },
+    _oidAppleSecureBootCertSpec[]   = { APPLE_SBOOT_CERT_EXTEN_SBOOT_SPEC_OID },
+    _oidAppleProvisioningProfile[]  = {APPLE_PROVISIONING_PROFILE_OID },
+    _oidAppleApplicationSigning[]   = { APPLE_APP_SIGNING_OID },
+    _oidAppleInstallerPackagingSigningExternal[]       = { APPLE_INSTALLER_PACKAGE_SIGNING_EXTERNAL_OID },
+    _oidAppleExtendedKeyUsageAppleID[] = { APPLE_EKU_APPLE_ID },
+    _oidAppleExtendedKeyUsageShoebox[] = { APPLE_EKU_SHOEBOX },
+    _oidAppleExtendedKeyUsageProfileSigning[] = { APPLE_EKU_PROFILE_SIGNING },
+    _oidAppleExtendedKeyUsageQAProfileSigning[] = { APPLE_EKU_QA_PROFILE_SIGNING },
+    _oidAppleIntmMarkerAppleID[] = { APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLEID },
+    _oidAppleIntmMarkerAppleID2[] = {APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLEID_2 },
+    _oidApplePushServiceClient[]   =   { APPLE_CERT_EXT_APPLE_PUSH_MARKER, 2 },
+    _oidApplePolicyMobileStore[]  = { APPLE_CERT_POLICY_MOBILE_STORE },
+    _oidApplePolicyTestMobileStore[] = { APPLE_CERT_POLICY_TEST_MOBILE_STORE },
+    _oidApplePolicyEscrowService[] = { APPLE_ESCROW_POLICY_OID },
+    _oidAppleCertExtensionAppleIDRecordValidationSigning[] = { APPLE_CERT_EXT_APPLE_ID_VALIDATION_RECORD_SIGNING },
+    _oidAppleIntmMarkerAppleSystemIntg2[] =  {APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLEID_SYSTEM_INTEGRATION_2},
+    _oidAppleIntmMarkerAppleSystemIntgG3[] =  {APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLEID_SYSTEM_INTEGRATION_G3},
+    _oidAppleCertExtAppleSMPEncryption[] = {APPLE_CERT_EXT_APPLE_SMP_ENCRYPTION},
+    _oidAppleCertExtAppleServerAuthentication[] = {APPLE_CERT_EXT_APPLE_SERVER_AUTHENTICATION},
+    _oidAppleIntmMarkerAppleServerAuthentication[] = {APPLE_CERT_EXT_INTERMEDIATE_MARKER_APPLE_SERVER_AUTHENTICATION};
+
+const DERItem
+    oidSubjectKeyIdentifier         = { (DERByte *)_oidSubjectKeyIdentifier,
+                                        sizeof(_oidSubjectKeyIdentifier) },
+    oidKeyUsage                     = { (DERByte *)_oidKeyUsage,
+                                        sizeof(_oidKeyUsage) },
+    oidPrivateKeyUsagePeriod        = { (DERByte *)_oidPrivateKeyUsagePeriod,
+                                        sizeof(_oidPrivateKeyUsagePeriod) },
+    oidSubjectAltName               = { (DERByte *)_oidSubjectAltName,
+                                        sizeof(_oidSubjectAltName) },
+    oidIssuerAltName                = { (DERByte *)_oidIssuerAltName,
+                                        sizeof(_oidIssuerAltName) },
+    oidBasicConstraints             = { (DERByte *)_oidBasicConstraints,
+                                        sizeof(_oidBasicConstraints) },
+    oidCrlDistributionPoints        = { (DERByte *)_oidCrlDistributionPoints,
+                                        sizeof(_oidCrlDistributionPoints) },
+    oidCertificatePolicies          = { (DERByte *)_oidCertificatePolicies,
+                                        sizeof(_oidCertificatePolicies) },
+    oidAnyPolicy                    = { (DERByte *)_oidAnyPolicy,
+                                        sizeof(_oidAnyPolicy) },
+    oidPolicyMappings               = { (DERByte *)_oidPolicyMappings,
+                                        sizeof(_oidPolicyMappings) },
+    oidAuthorityKeyIdentifier       = { (DERByte *)_oidAuthorityKeyIdentifier,
+                                        sizeof(_oidAuthorityKeyIdentifier) },
+    oidPolicyConstraints            = { (DERByte *)_oidPolicyConstraints,
+                                        sizeof(_oidPolicyConstraints) },
+    oidExtendedKeyUsage             = { (DERByte *)_oidExtendedKeyUsage,
+                                        sizeof(_oidExtendedKeyUsage) },
+    oidAnyExtendedKeyUsage          = { (DERByte *)_oidAnyExtendedKeyUsage,
+                                        sizeof(_oidAnyExtendedKeyUsage) },
+    oidInhibitAnyPolicy             = { (DERByte *)_oidInhibitAnyPolicy,
+                                        sizeof(_oidInhibitAnyPolicy) },
+    oidAuthorityInfoAccess          = { (DERByte *)_oidAuthorityInfoAccess,
+                                        sizeof(_oidAuthorityInfoAccess) },
+    oidSubjectInfoAccess            = { (DERByte *)_oidSubjectInfoAccess,
+                                        sizeof(_oidSubjectInfoAccess) },
+    oidAdOCSP                       = { (DERByte *)_oidAdOCSP,
+                                        sizeof(_oidAdOCSP) },
+    oidAdCAIssuer                   = { (DERByte *)_oidAdCAIssuer,
+                                        sizeof(_oidAdCAIssuer) },
+    oidNetscapeCertType             = { (DERByte *)_oidNetscapeCertType,
+                                        sizeof(_oidNetscapeCertType) },
+    oidEntrustVersInfo              = { (DERByte *)_oidEntrustVersInfo,
+                                        sizeof(_oidEntrustVersInfo) },
+    oidMSNTPrincipalName              = { (DERByte *)_oidMSNTPrincipalName,
+                                        sizeof(_oidMSNTPrincipalName) },
+    /* Policy Qualifier IDs for Internet policy qualifiers. */
+    oidQtCps                        = { (DERByte *)_oidQtCps,
+                                        sizeof(_oidQtCps) },
+    oidQtUNotice                    = { (DERByte *)_oidQtUNotice,
+                                        sizeof(_oidQtUNotice) },
+    /* X.501 Name IDs. */
+    oidCommonName                   = { (DERByte *)_oidCommonName,
+                                        sizeof(_oidCommonName) },
+    oidCountryName                  = { (DERByte *)_oidCountryName,
+                                        sizeof(_oidCountryName) },
+    oidLocalityName                 = { (DERByte *)_oidLocalityName,
+                                        sizeof(_oidLocalityName) },
+    oidStateOrProvinceName          = { (DERByte *)_oidStateOrProvinceName,
+                                        sizeof(_oidStateOrProvinceName) },
+    oidOrganizationName             = { (DERByte *)_oidOrganizationName,
+                                        sizeof(_oidOrganizationName) },
+    oidOrganizationalUnitName       = { (DERByte *)_oidOrganizationalUnitName,
+                                        sizeof(_oidOrganizationalUnitName) },
+    oidDescription                  = { (DERByte *)_oidDescription,
+                                        sizeof(_oidDescription) },
+    oidEmailAddress                 = { (DERByte *)_oidEmailAddress,
+                                        sizeof(_oidEmailAddress) },
+    oidFriendlyName                 = { (DERByte *)_oidFriendlyName,
+                                        sizeof(_oidFriendlyName) },
+    oidLocalKeyId                   = { (DERByte *)_oidLocalKeyId,
+                                        sizeof(_oidLocalKeyId) },
+    oidExtendedKeyUsageServerAuth   = { (DERByte *)_oidExtendedKeyUsageServerAuth,
+                                        sizeof(_oidExtendedKeyUsageServerAuth) },
+    oidExtendedKeyUsageClientAuth   = { (DERByte *)_oidExtendedKeyUsageClientAuth,
+                                        sizeof(_oidExtendedKeyUsageClientAuth) },
+    oidExtendedKeyUsageCodeSigning  = { (DERByte *)_oidExtendedKeyUsageCodeSigning,
+                                        sizeof(_oidExtendedKeyUsageCodeSigning) },
+    oidExtendedKeyUsageEmailProtection  = { (DERByte *)_oidExtendedKeyUsageEmailProtection,
+                                        sizeof(_oidExtendedKeyUsageEmailProtection) },
+    oidExtendedKeyUsageOCSPSigning  = { (DERByte *)_oidExtendedKeyUsageOCSPSigning,
+                                        sizeof(_oidExtendedKeyUsageOCSPSigning) },
+    oidExtendedKeyUsageIPSec        = { (DERByte *)_oidExtendedKeyUsageIPSec,
+                                        sizeof(_oidExtendedKeyUsageIPSec) },
+    oidExtendedKeyUsageMicrosoftSGC = { (DERByte *)_oidExtendedKeyUsageMicrosoftSGC,
+                                        sizeof(_oidExtendedKeyUsageMicrosoftSGC) },
+    oidExtendedKeyUsageNetscapeSGC  = { (DERByte *)_oidExtendedKeyUsageNetscapeSGC,
+                                        sizeof(_oidExtendedKeyUsageNetscapeSGC) },
+    oidAppleSecureBootCertSpec      = { (DERByte *)_oidAppleSecureBootCertSpec,
+                                        sizeof(_oidAppleSecureBootCertSpec) },
+    oidAppleProvisioningProfile     = { (DERByte *)_oidAppleProvisioningProfile,
+                                        sizeof(_oidAppleProvisioningProfile) },
+    oidAppleApplicationSigning      = { (DERByte *)_oidAppleApplicationSigning,
+                                         sizeof(_oidAppleApplicationSigning) },
+    oidAppleInstallerPackagingSigningExternal          = { (DERByte *)_oidAppleInstallerPackagingSigningExternal,
+                                                            sizeof(_oidAppleInstallerPackagingSigningExternal) },
+    oidAppleExtendedKeyUsageAppleID = { (DERByte *)_oidAppleExtendedKeyUsageAppleID,
+                                        sizeof(_oidAppleExtendedKeyUsageAppleID) },
+    oidAppleExtendedKeyUsageShoebox = { (DERByte *)_oidAppleExtendedKeyUsageShoebox,
+                                        sizeof(_oidAppleExtendedKeyUsageShoebox) },
+    oidAppleExtendedKeyUsageProfileSigning
+                                     = { (DERByte *)_oidAppleExtendedKeyUsageProfileSigning,
+                                        sizeof(_oidAppleExtendedKeyUsageProfileSigning) },
+    oidAppleExtendedKeyUsageQAProfileSigning
+                                    = { (DERByte *)_oidAppleExtendedKeyUsageQAProfileSigning,
+                                        sizeof(_oidAppleExtendedKeyUsageQAProfileSigning) },
+    oidAppleIntmMarkerAppleID       = { (DERByte *)_oidAppleIntmMarkerAppleID,
+                                        sizeof(_oidAppleIntmMarkerAppleID) },
+    oidAppleIntmMarkerAppleID2      = { (DERByte *)_oidAppleIntmMarkerAppleID2,
+                                        sizeof(_oidAppleIntmMarkerAppleID2) },
+    oidApplePushServiceClient       = { (DERByte *)_oidAppleIntmMarkerAppleID2,
+                                        sizeof(_oidAppleIntmMarkerAppleID2) },
+    oidApplePolicyMobileStore       = { (DERByte *)_oidApplePolicyMobileStore,
+                                        sizeof(_oidApplePolicyMobileStore)},
+    oidApplePolicyTestMobileStore   = { (DERByte *)_oidApplePolicyTestMobileStore,
+                                        sizeof(_oidApplePolicyTestMobileStore)},
+    oidApplePolicyEscrowService     = { (DERByte *)_oidApplePolicyEscrowService,
+                                        sizeof(_oidApplePolicyEscrowService)},
+    oidAppleCertExtensionAppleIDRecordValidationSigning = { (DERByte *)_oidAppleCertExtensionAppleIDRecordValidationSigning,
+                                        sizeof(_oidAppleCertExtensionAppleIDRecordValidationSigning)},
+    oidAppleIntmMarkerAppleSystemIntg2 = { (DERByte *) _oidAppleIntmMarkerAppleSystemIntg2,
+                                        sizeof(_oidAppleIntmMarkerAppleSystemIntg2)},
+    oidAppleIntmMarkerAppleSystemIntgG3 = { (DERByte *) _oidAppleIntmMarkerAppleSystemIntgG3,
+                                        sizeof(_oidAppleIntmMarkerAppleSystemIntgG3)},
+    oidAppleCertExtAppleSMPEncryption = { (DERByte *)_oidAppleCertExtAppleSMPEncryption,
+                                        sizeof(_oidAppleCertExtAppleSMPEncryption)},
+    oidAppleCertExtAppleServerAuthentication
+                                      = { (DERByte *)_oidAppleCertExtAppleServerAuthentication,
+                                        sizeof(_oidAppleCertExtAppleServerAuthentication) },
+    oidAppleIntmMarkerAppleServerAuthentication
+                                      = { (DERByte *)_oidAppleIntmMarkerAppleServerAuthentication,
+                                        sizeof(_oidAppleIntmMarkerAppleServerAuthentication) };
+
+
+bool DEROidCompare(const DERItem *oid1, const DERItem *oid2) {
+	if ((oid1 == NULL) || (oid2 == NULL)) {
+		return false;
+	}
+	if (oid1->length != oid2->length) {
+		return false;
+	}
+	if (!DERMemcmp(oid1->data, oid2->data, oid1->length)) {
+		return true;
+	} else {
+		return false;
+	}
+}
diff --git a/view/kernelcache/core/transformers/libDER/oids.h b/view/kernelcache/core/transformers/libDER/oids.h
new file mode 100644
index 00000000..33ddabca
--- /dev/null
+++ b/view/kernelcache/core/transformers/libDER/oids.h
@@ -0,0 +1,137 @@
+/*
+ * Copyright (c) 2005-2009,2011-2014 Apple Inc. All Rights Reserved.
+ *
+ * @APPLE_LICENSE_HEADER_START@
+ * 
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this
+ * file.
+ * 
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ * 
+ * @APPLE_LICENSE_HEADER_END@
+ */
+
+
+/*
+ * oids.h - declaration of OID consts
+ *
+ */
+
+#ifndef	_LIB_DER_OIDS_H_
+#define _LIB_DER_OIDS_H_
+
+#include <libDER/libDER.h>
+#include <stdbool.h>
+
+#ifdef __cplusplus
+extern "C" {
+#endif
+
+/* Algorithm oids. */
+extern const DERItem
+    oidRsa,         /* PKCS1 RSA encryption, used to identify RSA keys */
+    oidMd2Rsa,      /* PKCS1 md2withRSAEncryption signature alg */
+    oidMd5Rsa,      /* PKCS1 md5withRSAEncryption signature alg */
+    oidSha1Rsa,     /* PKCS1 sha1withRSAEncryption signature alg */
+    oidSha256Rsa,   /* PKCS1 sha256WithRSAEncryption signature alg */
+    oidEcPubKey,    /* ECDH or ECDSA public key in a certificate */
+    oidSha1Ecdsa,   /* ECDSA with SHA1 signature alg */
+    oidSha224Ecdsa, /* ECDSA with SHA224 signature alg */
+    oidSha256Ecdsa, /* ECDSA with SHA256 signature alg */
+    oidSha384Ecdsa, /* ECDSA with SHA384 signature alg */
+    oidSha512Ecdsa, /* ECDSA with SHA512 signature alg */
+    oidMd2,         /* OID_RSA_HASH 2 */
+    oidMd4,         /* OID_RSA_HASH 4 */
+    oidMd5,         /* OID_RSA_HASH 5 */
+    oidSha1,        /* OID_OIW_ALGORITHM 26 */
+    oidSha256,      /* OID_NIST_HASHALG 1 */
+    oidSha384,      /* OID_NIST_HASHALG 2 */
+    oidSha512,      /* OID_NIST_HASHALG 3 */
+    oidSha224;      /* OID_NIST_HASHALG 4 */
+
+/* Standard X.509 Cert and CRL extensions. */
+extern const DERItem
+    oidSubjectKeyIdentifier,
+    oidKeyUsage,
+    oidPrivateKeyUsagePeriod,
+    oidSubjectAltName,
+    oidIssuerAltName,
+    oidBasicConstraints,
+    oidCrlDistributionPoints,
+    oidCertificatePolicies,
+    oidAnyPolicy,
+    oidPolicyMappings,
+    oidAuthorityKeyIdentifier,
+    oidPolicyConstraints,
+    oidExtendedKeyUsage,
+    oidAnyExtendedKeyUsage,
+    oidInhibitAnyPolicy,
+    oidAuthorityInfoAccess,
+    oidSubjectInfoAccess,
+    oidAdOCSP,
+    oidAdCAIssuer,
+    oidNetscapeCertType,
+    oidEntrustVersInfo,
+    oidMSNTPrincipalName,
+    /* Policy Qualifier IDs for Internet policy qualifiers. */
+    oidQtCps,
+    oidQtUNotice,
+    /* X.501 Name IDs. */
+    oidCommonName,
+    oidCountryName,
+    oidLocalityName,
+    oidStateOrProvinceName,
+    oidOrganizationName,
+    oidOrganizationalUnitName,
+    oidDescription,
+    oidEmailAddress,
+    oidFriendlyName,
+    oidLocalKeyId,
+    oidExtendedKeyUsageServerAuth,
+    oidExtendedKeyUsageClientAuth,
+    oidExtendedKeyUsageCodeSigning,
+    oidExtendedKeyUsageEmailProtection,
+    oidExtendedKeyUsageOCSPSigning,
+    oidExtendedKeyUsageIPSec,
+    oidExtendedKeyUsageMicrosoftSGC,
+    oidExtendedKeyUsageNetscapeSGC,
+    /* Secure Boot Spec oid */
+    oidAppleSecureBootCertSpec,
+    oidAppleProvisioningProfile,
+    oidAppleApplicationSigning,
+    oidAppleInstallerPackagingSigningExternal,
+    oidAppleExtendedKeyUsageAppleID,
+    oidAppleExtendedKeyUsageShoebox,
+    oidAppleExtendedKeyUsageProfileSigning,
+    oidAppleExtendedKeyUsageQAProfileSigning,
+    oidAppleIntmMarkerAppleID,
+    oidAppleIntmMarkerAppleID2,
+    oidApplePushServiceClient,
+    oidApplePolicyMobileStore,
+    oidApplePolicyTestMobileStore,
+    oidApplePolicyEscrowService,
+    oidAppleCertExtensionAppleIDRecordValidationSigning,
+    oidAppleIntmMarkerAppleSystemIntg2,
+    oidAppleIntmMarkerAppleSystemIntgG3,
+    oidAppleCertExtAppleSMPEncryption,
+    oidAppleCertExtAppleServerAuthentication,
+    oidAppleIntmMarkerAppleServerAuthentication;
+
+/* Compare two decoded OIDs.  Returns true iff they are equivalent. */
+bool DEROidCompare(const DERItem *oid1, const DERItem *oid2);
+
+#ifdef __cplusplus
+}
+#endif
+
+#endif	/* _LIB_DER_UTILS_H_ */