Method ParseHeaderForAddress

view/sharedcache/core/MachO.cpp:34–458

}

std::optional<SharedCacheMachOHeader> SharedCacheMachOHeader::ParseHeaderForAddress(
	std::shared_ptr<VirtualMemory> vm, uint64_t address, const std::string& imagePath)
{
	// Sanity check to make sure that the header is mapped.
	// This should really only fail if we didn't grab all the required entries.
	if (!vm->IsAddressMapped(address))
		return std::nullopt;

	SharedCacheMachOHeader header;

	header.textBase = address;
	header.installName = imagePath;
	// The identifierPrefix is used for the display of the image name in the sections and segments.
	header.identifierPrefix = BaseFileName(imagePath);

	std::string errorMsg;
	VirtualMemoryReader reader(vm);
	reader.Seek(address);

	header.ident.magic = reader.ReadUInt32();

	BNEndianness endianness;
	switch (header.ident.magic)
	{
	case MH_MAGIC:
	case MH_MAGIC_64:
		endianness = LittleEndian;
		break;
	case MH_CIGAM:
	case MH_CIGAM_64:
		endianness = BigEndian;
		break;
	default:
		return {};
	}

	reader.SetEndianness(endianness);
	header.ident.cputype = reader.ReadUInt32();
	header.ident.cpusubtype = reader.ReadUInt32();
	header.ident.filetype = reader.ReadUInt32();
	header.ident.ncmds = reader.ReadUInt32();
	header.ident.sizeofcmds = reader.ReadUInt32();
	header.ident.flags = reader.ReadUInt32();
	if ((header.ident.cputype & MachOABIMask) == MachOABI64)  // address size == 8
	{
		header.ident.reserved = reader.ReadUInt32();
	}
	header.loadCommandOffset = reader.GetOffset();

	bool first = true;
	// Parse segment commands
	try
	{
		for (size_t i = 0; i < header.ident.ncmds; i++)
		{
			// BNLogInfo("of 0x%llx", reader.GetOffset());
			load_command load;
			segment_command_64 segment64;