search

slavaim / MacOSX-FileSystem-Filter

A file system filter for Mac OS X
96 stars 34 forks source link

Crash in Sierra 10.12 due to changes in vnode struct #5

Closed syarragu closed 7 years ago

syarragu commented 7 years ago

Hi Slava,

I printed the vNodeHeaderSize and vNodeVopOffset in FltGetVnodeLayout() and in Sierra its given as 224 and 208 where as in Yosemite and Elcapitan the values are 216 and 200.

This cléarly shows that the Vnode structure has changed for sierra. But my question is If I want to define Vnode_sieraa like as Vnode_yosemite, how will i know what was changed??

can you please suggest how to proceed

slavaim commented 7 years ago

Vnode_yosemite definition was borrowed from the xnu source code. As far as I know the latest xnu code available at https://opensource.apple.com/ is for 10.11. You can use a debugger to obtain 'struct vnode' definition from kernel debug symbols for 10.12.

slavaim commented 7 years ago

The issue has been fixed by activating a structure layout inference engine.