Method AddExportTerminalSymbol

view/sharedcache/core/MachO.cpp:557–607

}

bool SharedCacheMachOHeader::AddExportTerminalSymbol(
	std::vector<CacheSymbol>& symbols, const std::string& symbolName, const uint8_t *current, const uint8_t *end) const
{
	uint64_t symbolFlags = readValidULEB128(current, end);
	if (symbolFlags & EXPORT_SYMBOL_FLAGS_REEXPORT)
		return false;

	uint64_t imageOffset = readValidULEB128(current, end);
	uint64_t symbolAddress = textBase + imageOffset;
	if (symbolName.empty() || symbolAddress == 0)
		return false;

	// Tries to get the symbol type based off the section containing it.
	auto sectionSymbolType = [&]() -> BNSymbolType {
		uint32_t sectionFlags = 0;
		for (const auto& section : sections)
		{
			if (symbolAddress >= section.addr && symbolAddress < section.addr + section.size)
			{
				// Take the flags from the first containing section.
				sectionFlags = section.flags;
				break;
			}
		}

		// TODO: Is this enough to determine a function symbol?
		// TODO: Might be the cause of https://github.com/Vector35/binaryninja-api/issues/6526
		// Check the sections flags to see if we actually have a function symbol instead.
		if (sectionFlags & S_ATTR_PURE_INSTRUCTIONS || sectionFlags & S_ATTR_SOME_INSTRUCTIONS)
			return FunctionSymbol;

		// By default, just return data symbol.
		return DataSymbol;
	};

	switch (symbolFlags & EXPORT_SYMBOL_FLAGS_KIND_MASK)
	{
	case EXPORT_SYMBOL_FLAGS_KIND_REGULAR:
	case EXPORT_SYMBOL_FLAGS_KIND_THREAD_LOCAL:
		symbols.emplace_back(sectionSymbolType(), symbolAddress, symbolName);
		break;
	case EXPORT_SYMBOL_FLAGS_KIND_ABSOLUTE:
		symbols.emplace_back(DataSymbol, symbolAddress, symbolName);
		break;
	default:
		LogWarn("Unhandled export symbol kind: %llx", symbolFlags & EXPORT_SYMBOL_FLAGS_KIND_MASK);
		return false;
	}

	return true;
}

std::vector<CacheSymbol> SharedCacheMachOHeader::ReadExportSymbolTrie(VirtualMemory& vm) const
{