MCPcopy Create free account
hub / github.com/Vector35/binaryninja-api / PerformInitialLoad

Method PerformInitialLoad

view/kernelcache/core/KernelCache.cpp:202–326  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

200} // namespace
201
202void KernelCache::PerformInitialLoad(std::lock_guard<std::mutex>& lock)
203{
204 bool is64 = m_kcView->GetAddressSize() == 8;
205
206 m_logger->LogInfo("Performing initial load of Kernel Cache");
207
208 m_viewSpecificState->progress = LoadProgressLoadingCaches;
209
210 CacheInfo initialState;
211 initialState.cacheFormat = FilesetCacheFormat;
212
213 m_viewSpecificState->progress = LoadProgressLoadingImages;
214
215 // We have set up enough metadata to map VM now.
216 // Iterate load comands:
217 BinaryReader reader(m_kcView->GetParentView());
218
219 uint32_t magic = reader.Read32();
220 if (magic != MH_CIGAM_64 && magic != MH_MAGIC_64) // FIXME 32 bit
221 {
222 m_logger->LogError("Invalid magic number in KernelCache");
223 return;
224 }
225 uint32_t cpuType = reader.Read32();
226 reader.SeekRelative(4);
227 uint32_t fileType = reader.Read32();
228 if (fileType != MH_FILESET)
229 {
230 m_logger->LogError("Invalid file type in KernelCache");
231 return;
232 }
233 uint32_t ncmds = reader.Read32();
234 reader.SeekRelative(8);
235 if ((cpuType & MachOABIMask) != MachOABI64)
236 {
237 m_logger->LogError("Invalid ABI in KernelCache. 32 bit not yet supported.");
238 return;
239 }
240 if (is64)
241 reader.SeekRelative(4);
242
243 uint64_t off = reader.GetOffset();
244
245 while (ncmds--)
246 {
247 reader.Seek(off);
248 uint32_t cmd = reader.Read32();
249 uint32_t cmdsize = reader.Read32();
250 if (cmd == LC_FILESET_ENTRY)
251 {
252 // uint64_t vmAddr =reader.Read64();
253 reader.SeekRelative(m_kcView->GetAddressSize());
254 uint64_t fileOff = reader.Read64();
255 uint32_t entryID = reader.Read32();
256 reader.Seek(entryID + off);
257 std::string installName = reader.ReadCString(0x1000);
258 initialState.imageStarts[installName] = fileOff;
259 }

Callers

nothing calls this directly

Calls 15

LogInfoMethod · 0.80
GetParentViewMethod · 0.80
LogErrorMethod · 0.80
push_backMethod · 0.80
c_strMethod · 0.80
LogDebugMethod · 0.80
GetAddressSizeMethod · 0.45
Read32Method · 0.45
SeekRelativeMethod · 0.45
GetOffsetMethod · 0.45
SeekMethod · 0.45
Read64Method · 0.45

Tested by

no test coverage detected