MCPcopy Create free account
hub / github.com/Vector35/binaryninja-api / Init

Method Init

view/kernelcache/core/KCView.cpp:45–706  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

43};
44
45bool KCView::Init()
46{
47 BinaryReader reader(GetParentView());
48 reader.Seek(0x4);
49 uint32_t cpuType = reader.Read32();
50 reader.Seek(0x10);
51 uint64_t ncmds = reader.Read32();
52 uint64_t sizeofcmds = reader.Read32();
53
54 // get __TEXT seg offset
55 uint64_t textSegOffset = 0;
56 uint64_t anyFilesetHeaderFileOffset = 0;
57 uint64_t offset = 0x20;
58 for (uint64_t i = 0; i < ncmds; i++)
59 {
60 reader.Seek(offset);
61 uint64_t cmd = reader.Read32();
62 uint64_t cmdsize = reader.Read32();
63 if (textSegOffset == 0 && cmd == LC_SEGMENT_64)
64 {
65 uint64_t segname = reader.Read64();
66 reader.Read64();
67 uint64_t vmaddr = reader.Read64();
68 if (segname == 0x545845545f5f) // __TEXT
69 {
70 textSegOffset = vmaddr;
71 }
72 }
73
74 if (anyFilesetHeaderFileOffset == 0 && cmd == LC_FILESET_ENTRY)
75 {
76 reader.SeekRelative(8);
77 anyFilesetHeaderFileOffset = reader.Read64();
78 }
79
80 offset += cmdsize;
81 if (textSegOffset && anyFilesetHeaderFileOffset)
82 break;
83 }
84
85 Ref<Platform> platform;
86 Ref<Architecture> architecture;
87
88 if (anyFilesetHeaderFileOffset)
89 {
90 reader.Seek(anyFilesetHeaderFileOffset);
91 reader.SeekRelative(0x10);
92
93 uint64_t ncmdsFH = reader.Read32();
94
95 reader.Seek(anyFilesetHeaderFileOffset + 0x20);
96 offset = anyFilesetHeaderFileOffset + 0x20;
97 bool foundBuildVersion = false;
98 for (uint64_t i = 0; i < ncmdsFH; i++)
99 {
100 reader.Seek(offset);
101 uint64_t cmd = reader.Read32();
102 uint64_t cmdsize = reader.Read32();

Callers 1

Calls 15

EnumerationTypeClass · 0.85
IntegerTypeClass · 0.85
StructureTypeClass · 0.85
ArrayTypeClass · 0.85
RecognizePlatformMethod · 0.80
AddMemberMethod · 0.80
LoadedImagesMethod · 0.80
c_strMethod · 0.80
QualifiedNameClass · 0.50
SeekMethod · 0.45
Read32Method · 0.45
Read64Method · 0.45

Tested by

no test coverage detected