File tree Expand file tree Collapse file tree 1 file changed +9
-0
lines changed
Expand file tree Collapse file tree 1 file changed +9
-0
lines changed Original file line number Diff line number Diff line change @@ -3743,6 +3743,15 @@ bool MachoViewType::IsTypeValidForData(BinaryView* data)
37433743 if ((magic == FAT_MAGIC) || (magic == FAT_MAGIC_64))
37443744 return true ;
37453745
3746+ // If it's an MH_FILESET, return false, these are now handled by the KernelCache plugin by default
3747+ DataBuffer header = data->ReadBuffer (data->GetStart (), sizeof (mach_header_64));
3748+ if (header.GetLength () < sizeof (mach_header_64))
3749+ return false ;
3750+ const mach_header_64* mh = (const mach_header_64*)header.GetData ();
3751+ uint32_t filetype = mh->magic == MH_MAGIC_64 || mh->magic == MH_MAGIC ? mh->filetype : ToBE32 (mh->filetype );
3752+ if (filetype == MH_FILESET)
3753+ return false ;
3754+
37463755 return data->GetLoadSettings (GetName ()) ? true : false ;
37473756}
37483757
You can’t perform that action at this time.
0 commit comments