Skip to content

Avoid creating functions at jump table entries in shared cache#8002

Open
plafosse wants to merge 1 commit intodevfrom
fix/shared-cache-jump-table-functions
Open

Avoid creating functions at jump table entries in shared cache#8002
plafosse wants to merge 1 commit intodevfrom
fix/shared-cache-jump-table-functions

Conversation

@plafosse
Copy link
Member

@plafosse plafosse commented Mar 9, 2026

Summary

  • When processing shared cache Mach-O function tables, Binary Ninja was creating functions at addresses that turn out to be jump table entries rather than real function starts, producing spurious sub_ functions.
  • Adds a HeuristicIsAFunction check before calling AddFunctionForAnalysis. On aarch64, if the first instruction at the candidate address disassembles as udf, the entry is skipped — udf is used as padding/data in jump tables and is never a valid function prologue.
  • This heuristic is admittedly a bit rough and could produce false negatives in unusual cases, but it directly addresses the reported symptom.

Fix #7992

…on tables

Add a heuristic to skip creating functions at addresses that appear to be
jump table entries rather than actual function starts. On aarch64, any
entry that disassembles as a `udf` instruction is skipped, since `udf` is
used as padding/data in jump tables and is not a valid function prologue.

Fix #7992
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Functions are being created for jump tables in code sections

1 participant