Skip to content

Commit f783454

Browse files
committed
More gracefully ignore MH_FILESET in MachOView.
This avoids the 3 errors on view initialization for all supported kernel caches that aren't "real".
1 parent 21cf936 commit f783454

File tree

1 file changed

+9
-0
lines changed

1 file changed

+9
-0
lines changed

view/macho/machoview.cpp

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3743,6 +3743,15 @@ bool MachoViewType::IsTypeValidForData(BinaryView* data)
37433743
if ((magic == FAT_MAGIC) || (magic == FAT_MAGIC_64))
37443744
return true;
37453745

3746+
// If it's an MH_FILESET, return false, these are now handled by the KernelCache plugin by default
3747+
DataBuffer header = data->ReadBuffer(data->GetStart(), sizeof(mach_header_64));
3748+
if (header.GetLength() < sizeof(mach_header_64))
3749+
return false;
3750+
const mach_header_64* mh = (const mach_header_64*)header.GetData();
3751+
uint32_t filetype = mh->magic == MH_MAGIC_64 || mh->magic == MH_MAGIC ? mh->filetype : ToBE32(mh->filetype);
3752+
if (filetype == MH_FILESET)
3753+
return false;
3754+
37463755
return data->GetLoadSettings(GetName()) ? true : false;
37473756
}
37483757

0 commit comments

Comments
 (0)