| 3883 | |
| 3884 | |
| 3885 | uint64_t MachoViewType::ParseHeaders(BinaryView* data, uint64_t imageOffset, mach_header_64& ident, Ref<Architecture>* arch, Ref<Platform>* plat, string& errorMsg) |
| 3886 | { |
| 3887 | DataBuffer sig = data->ReadBuffer(imageOffset, 4); |
| 3888 | uint32_t magic = *(uint32_t*)sig.GetData(); |
| 3889 | if ((sig.GetLength() != 4) || !(magic == MH_CIGAM || magic == MH_CIGAM_64 || magic == MH_MAGIC || magic == MH_MAGIC_64)) |
| 3890 | { |
| 3891 | errorMsg = "invalid signature"; |
| 3892 | return 0; |
| 3893 | } |
| 3894 | |
| 3895 | BinaryReader reader(data); |
| 3896 | reader.SetVirtualBase(imageOffset); |
| 3897 | ident.magic = reader.Read32(); |
| 3898 | |
| 3899 | BNEndianness endianness; |
| 3900 | if (ident.magic == MH_MAGIC || ident.magic == MH_MAGIC_64) |
| 3901 | endianness = LittleEndian; |
| 3902 | else if (ident.magic == MH_CIGAM || ident.magic == MH_CIGAM_64) |
| 3903 | endianness = BigEndian; |
| 3904 | else |
| 3905 | { |
| 3906 | errorMsg = "invalid file class"; |
| 3907 | return 0; |
| 3908 | } |
| 3909 | |
| 3910 | reader.SetEndianness(endianness); |
| 3911 | ident.cputype = reader.Read32(); |
| 3912 | ident.cpusubtype = reader.Read32(); |
| 3913 | ident.filetype = reader.Read32(); |
| 3914 | ident.ncmds = reader.Read32(); |
| 3915 | ident.sizeofcmds = reader.Read32(); |
| 3916 | ident.flags = reader.Read32(); |
| 3917 | |
| 3918 | if ((ident.cputype & MachOABIMask) == MachOABI64) // address size == 8 |
| 3919 | { |
| 3920 | ident.reserved = reader.Read32(); |
| 3921 | } |
| 3922 | if (!(ident.filetype == MH_OBJECT || |
| 3923 | ident.filetype == MH_EXECUTE || |
| 3924 | ident.filetype == MH_DYLIB || |
| 3925 | ident.filetype == MH_DYLINKER || |
| 3926 | ident.filetype == MH_BUNDLE || |
| 3927 | ident.filetype == MH_KEXT_BUNDLE || |
| 3928 | ident.filetype == MH_CORE || |
| 3929 | ident.filetype == MH_PRELOAD || |
| 3930 | ident.filetype == MH_DSYM || |
| 3931 | ident.filetype == MH_FILESET)) |
| 3932 | { |
| 3933 | m_logger->LogError("Unhandled Macho file class: 0x%x", ident.filetype); |
| 3934 | errorMsg = "invalid file class"; |
| 3935 | return 0; |
| 3936 | } |
| 3937 | uint64_t loadCommandStart = reader.GetOffset(); |
| 3938 | |
| 3939 | uint32_t cmd; |
| 3940 | uint32_t cmdsize; |
| 3941 | MachoPlatform machoPlat = MachoPlatform::MACHO_PLATFORM_MACOS; // Default to macOS. |
| 3942 | // Quickly determine the OS from commands. |
no test coverage detected