Method InitializeSegmentsForHeader

view/kernelcache/core/KernelCache.cpp:1044–1392

}

bool KernelCache::InitializeSegmentsForHeader(Ref<BinaryView> view, const KernelCacheMachOHeader& header, const KernelCacheImage& targetImage)
{
	// FIXME this uselessly loads chained fixups if an image is already loaded.
	auto logger = LogRegistry::GetLogger("KernelCache", view->GetFile()->GetSessionId());

	bool hasRegionsToLoad = false;

	auto reader = BinaryReader(view->GetParentView());

	reader.Seek(0x10);
	uint32_t ncmds = reader.Read32();
	uint64_t off = 0x20; // FIXME 32 bit

	uint64_t kernelBaseAddress = 0;

	uint32_t chainedFixupDataOff = 0;
	uint32_t chainedFixupDataSize = 0;

	while (ncmds--)
	{
		reader.Seek(off);
		uint32_t cmd = reader.Read32();
		uint32_t cmdsize = reader.Read32();
		if (cmd == LC_SEGMENT_64)
		{
			segment_command_64 segment {};
			reader.Read(&segment.segname, 16);
			if (strncmp(segment.segname, "__TEXT\0", 7) == 0)
			{
				kernelBaseAddress = reader.Read64();
			}
		}
		if (cmd == LC_DYLD_CHAINED_FIXUPS)
		{
			chainedFixupDataOff = reader.Read32();
			chainedFixupDataSize = reader.Read32();
		}
		off += cmdsize;
	}

	BNRelocationInfo reloc;
	memset(&reloc, 0, sizeof(BNRelocationInfo));
	reloc.type = StandardRelocationType;
	reloc.size = 8;
	reloc.nativeType = BINARYNINJA_MANUAL_RELOCATION;
	logger->LogDebug("Processing Chained Fixups");

	std::vector<std::pair<uint64_t, uint64_t>> relocations;
	if (chainedFixupDataOff && chainedFixupDataSize)
	{
		BinaryReader parentReader(view->GetParentView());

		try {
			dyld_chained_fixups_header fixupsHeader {};
			uint64_t fixupHeaderAddress = chainedFixupDataOff;
			parentReader.Seek(fixupHeaderAddress);
			fixupsHeader.fixups_version = parentReader.Read32();
			fixupsHeader.starts_offset = parentReader.Read32();