Ejemplo n.º 1
0
 private KeyGenerator CreateGenerator(MachLoadedImage loadedImage)
 {
     try
     {
         if (loadedImage.Image.IsValid())
         {
             return(new MachOFileKeyGenerator(Tracer, loadedImage.Image, loadedImage.Path));
         }
         // TODO - mikem 7/1/17 - need to figure out a better way to determine the file vs loaded layout
         bool          layout     = loadedImage.Path.StartsWith("/");
         IAddressSpace dataSource = _core.VirtualAddressReader.DataSource;
         var           peFile     = new PEFile(new RelativeAddressSpace(dataSource, loadedImage.LoadAddress, dataSource.Length), layout);
         if (peFile.IsValid())
         {
             return(new PEFileKeyGenerator(Tracer, peFile, loadedImage.Path));
         }
         Tracer.Warning("Unknown Mach core image {0:X16} {1}", loadedImage.LoadAddress, loadedImage.Path);
     }
     catch (InvalidVirtualAddressException ex)
     {
         Tracer.Error("{0}: {1:X16} {2}", ex.Message, loadedImage.LoadAddress, loadedImage.Path);
     }
     return(null);
 }
Ejemplo n.º 2
0
 public MachDumpModule(MachLoadedImage loadedImage)
 {
     _loadedImage = loadedImage;
 }