dyld_shared_cache.bt 010 Editor Binary template

dyld_shared_cache.bt

//--------------------------------------
//--- 010 Editor v3.2.2 Binary Template
//
// File: dyld_shared_cache.bt
// Author: Eric Monti
// Revision: 0.0.1
// Purpose: Parses Mac/iOS dyld_shared_cache format
//--------------------------------------


typedef struct {
    char     magic[16];
    uint32   mappingOffset;
    uint32   mappingCount;
    uint32   imagesOffset;
    uint32   imagesCount;
    uint64   dyldBaseAddress;
} dyld_cache_header;

typedef struct {
    uint64       address;
    uint64       size;
    uint64       file_offset;
    uint32       max_prot;
    uint32       init_prot;
} shared_file_mapping_np;

typedef struct {
    uint64    address;
    uint64    modTime;
    uint64    inode;
    uint32    pathFileOffset;
    uint32    pad;
} dyld_cache_image_info;
////////////////////////////////////////////////////////////////


dyld_cache_header header;

FSeek(header.mappingOffset);
shared_file_mapping_np shared_file_map[header.mappingCount];

FSeek(header.imagesOffset);
dyld_cache_image_info images[header.imagesCount];