Method ReadExportNode

view/kernelcache/core/KernelCache.cpp:1795–1859

void KernelCache::ReadExportNode(Ref<BinaryView> view, std::vector<Ref<Symbol>>& symbolList, KernelCacheMachOHeader& header, DataBuffer& buffer, uint64_t textBase,
	const std::string& currentText, size_t cursor, uint32_t endGuard)
{

	if (cursor > endGuard)
		throw ReadException();

	uint64_t terminalSize = readValidULEB128(buffer, cursor);
	uint64_t childOffset = cursor + terminalSize;
	if (terminalSize != 0) {
		uint64_t imageOffset = 0;
		uint64_t flags = readValidULEB128(buffer, cursor);
		if (!(flags & EXPORT_SYMBOL_FLAGS_REEXPORT))
		{
			imageOffset = readValidULEB128(buffer, cursor);
			// auto symbolType = view->GetAnalysisFunctionsForAddress(textBase + imageOffset).size() ? FunctionSymbol : DataSymbol;
			{
				if (!currentText.empty() && textBase + imageOffset)
				{
					uint32_t sectionFlags;
					BNSymbolType type;
					for (auto s : header.sections)
					{
						if (s.addr < textBase + imageOffset)
						{
							if (s.addr + s.size > textBase + imageOffset)
							{
								sectionFlags = s.flags;
							}
						}
					}
					if ((sectionFlags & S_ATTR_PURE_INSTRUCTIONS) == S_ATTR_PURE_INSTRUCTIONS
						|| (sectionFlags & S_ATTR_SOME_INSTRUCTIONS) == S_ATTR_SOME_INSTRUCTIONS)
						type = FunctionSymbol;
					else
						type = DataSymbol;

#if EXPORT_TRIE_DEBUG
						// BNLogInfo("export: %s -> 0x%llx", n.text.c_str(), image.baseAddress + n.offset);
#endif
					auto sym = new Symbol(type, currentText, textBase + imageOffset);
					symbolList.push_back(sym);
				}
			}
		}
	}
	cursor = childOffset;
	uint8_t childCount = buffer[cursor];
	cursor++;
	if (cursor > endGuard)
		throw ReadException();
	for (uint8_t i = 0; i < childCount; ++i)
	{
		std::string childText;
		while (buffer[cursor] != 0 & cursor <= endGuard)
			childText.push_back(buffer[cursor++]);
		cursor++;
		if (cursor > endGuard)