Method Parse

view/kernelcache/core/KCView.cpp:832–869

BinaryNinja::Ref<BinaryNinja::BinaryView> KCViewType::Parse(BinaryNinja::BinaryView* data)
{
	uint32_t magic;
	data->Read(&magic, data->GetStart(), 4);
	if (magic != MH_CIGAM_64 && magic != MH_MAGIC_64) // FIXME 32 bit
	{
		uint32_t im4pMagic;
		data->Read(&im4pMagic, data->GetStart() + 0x8, 4);
		if (im4pMagic == 0x50344d49) // P4MI
		{
			auto img4 = Transform::GetByName("IMG4-Unencrypted");
			auto lzfse = Transform::GetByName("LZFSE");

			DataBuffer img4Payload;
			img4->Decode(data->ReadBuffer(data->GetStart(), data->GetLength()), img4Payload);
			DataBuffer machOPayload;
			lzfse->Decode(img4Payload, machOPayload);

			uint32_t magic = ((uint32_t*)machOPayload.GetData())[0];
			auto id = data->BeginUndoActions();
			if (magic == FAT_MAGIC_64)
			{
				DataBuffer output = machOPayload.GetSlice(0x1c, machOPayload.GetLength()-0x1c);
				data->WriteBuffer(0, output);
			}
			else
			{
				data->WriteBuffer(0, machOPayload);
			}
			data->ForgetUndoActions(id);
			return new KCView(KC_VIEW_NAME, data, true);
		}

		return nullptr;
	}

	return new KCView(KC_VIEW_NAME, data, true);
}

bool KCViewType::IsTypeValidForData(BinaryNinja::BinaryView* data)
{