diff options
| author | Alexander Taylor <alex@vector35.com> | 2025-04-08 15:37:31 -0400 |
|---|---|---|
| committer | Alexander Taylor <alex@vector35.com> | 2025-04-09 17:16:23 -0400 |
| commit | f78345462ebc25e0241d838f04104e5c6bfae863 (patch) | |
| tree | 9223caddeb1a6a9af7a665466a7ee4c9a381e892 /view/macho/machoview.cpp | |
| parent | 21cf9360ec88f1090360a0635abe2c511da4d9d7 (diff) | |
More gracefully ignore MH_FILESET in MachOView.
This avoids the 3 errors on view initialization for all supported kernel
caches that aren't "real".
Diffstat (limited to 'view/macho/machoview.cpp')
| -rw-r--r-- | view/macho/machoview.cpp | 9 |
1 files changed, 9 insertions, 0 deletions
diff --git a/view/macho/machoview.cpp b/view/macho/machoview.cpp index 34c11f69..df742c25 100644 --- a/view/macho/machoview.cpp +++ b/view/macho/machoview.cpp @@ -3743,6 +3743,15 @@ bool MachoViewType::IsTypeValidForData(BinaryView* data) if ((magic == FAT_MAGIC) || (magic == FAT_MAGIC_64)) return true; + // If it's an MH_FILESET, return false, these are now handled by the KernelCache plugin by default + DataBuffer header = data->ReadBuffer(data->GetStart(), sizeof(mach_header_64)); + if (header.GetLength() < sizeof(mach_header_64)) + return false; + const mach_header_64* mh = (const mach_header_64*)header.GetData(); + uint32_t filetype = mh->magic == MH_MAGIC_64 || mh->magic == MH_MAGIC ? mh->filetype : ToBE32(mh->filetype); + if (filetype == MH_FILESET) + return false; + return data->GetLoadSettings(GetName()) ? true : false; } |