From f78345462ebc25e0241d838f04104e5c6bfae863 Mon Sep 17 00:00:00 2001 From: Alexander Taylor Date: Tue, 8 Apr 2025 15:37:31 -0400 Subject: More gracefully ignore MH_FILESET in MachOView. This avoids the 3 errors on view initialization for all supported kernel caches that aren't "real". --- view/macho/machoview.cpp | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/view/macho/machoview.cpp b/view/macho/machoview.cpp index 34c11f69..df742c25 100644 --- a/view/macho/machoview.cpp +++ b/view/macho/machoview.cpp @@ -3743,6 +3743,15 @@ bool MachoViewType::IsTypeValidForData(BinaryView* data) if ((magic == FAT_MAGIC) || (magic == FAT_MAGIC_64)) return true; + // If it's an MH_FILESET, return false, these are now handled by the KernelCache plugin by default + DataBuffer header = data->ReadBuffer(data->GetStart(), sizeof(mach_header_64)); + if (header.GetLength() < sizeof(mach_header_64)) + return false; + const mach_header_64* mh = (const mach_header_64*)header.GetData(); + uint32_t filetype = mh->magic == MH_MAGIC_64 || mh->magic == MH_MAGIC ? mh->filetype : ToBE32(mh->filetype); + if (filetype == MH_FILESET) + return false; + return data->GetLoadSettings(GetName()) ? true : false; } -- cgit v1.3.1