Avoid creating functions at jump table entries in shared cache

view/macho/machoview.cpp

@@ -1103,22 +1103,7 @@ bool MachoView::IsValidFunctionStart(uint64_t addr)
 {
 	uint8_t opcode[BN_MAX_INSTRUCTION_LENGTH];
 	size_t opLen = Read(opcode, addr, m_arch->GetMaxInstructionLength());
-	if (!opLen)
-		return false;
-
-	Ref<LowLevelILFunction> ilFunc = new LowLevelILFunction(m_arch, nullptr);
-	ilFunc->SetCurrentAddress(m_arch, addr);
-	m_arch->GetInstructionLowLevelIL(opcode, addr, opLen, *ilFunc);
-	for (size_t i = 0; i < ilFunc->GetInstructionCount(); i++)
-	{
-		const auto& instr = ilFunc->GetInstruction(i);
-		if (instr.operation == LLIL_UNDEF)
-			return false;
-		if (i == 0 && instr.operation == LLIL_TRAP)
-			return false;
-	}
-
-	return true;
+	return BinaryNinja::IsValidFunctionStart(m_arch, addr, opcode, opLen);
 }
 
 

view/macho/machoview.h

@@ -5,6 +5,7 @@
 #include <string.h>
 
 #include "binaryninjaapi.h"
+#include "lowlevelilinstruction.h"
 #include "objc.h"
 
 //These are laready defined in one of the osx headers we want to override
@@ -1545,4 +1546,27 @@ namespace BinaryNinja
 	};
 
 	void InitMachoViewType();
+
+	// Check whether the instruction at `addr` looks like a valid function entry point.
+	// Returns false for undefined or trap instructions that typically indicate jump table entries.
+	// `opcode` must contain at least `opLen` bytes read from `addr`.
+	inline bool IsValidFunctionStart(Architecture* arch, uint64_t addr, const uint8_t* opcode, size_t opLen)
+	{
+		if (!opLen)
+			return false;
+
+		Ref<LowLevelILFunction> ilFunc = new LowLevelILFunction(arch, nullptr);
+		ilFunc->SetCurrentAddress(arch, addr);
+		arch->GetInstructionLowLevelIL(opcode, addr, opLen, *ilFunc);
+		for (size_t i = 0; i < ilFunc->GetInstructionCount(); i++)
+		{
+			const auto& instr = ilFunc->GetInstruction(i);
+			if (instr.operation == LLIL_UNDEF)
+				return false;
+			if (i == 0 && instr.operation == LLIL_TRAP)
+				return false;
+		}
+
+		return true;
+	}
 }

view/sharedcache/core/MachOProcessor.cpp

@@ -1,6 +1,8 @@
 #include "MachOProcessor.h"
 #include "SharedCache.h"
 
+#include <exception>
+
 using namespace BinaryNinja;
 
 SharedCacheMachOProcessor::SharedCacheMachOProcessor(Ref<BinaryView> view, std::shared_ptr<VirtualMemory> vm)
@@ -50,9 +52,24 @@ void SharedCacheMachOProcessor::ApplyHeader(const SharedCache& cache, SharedCach
 		if (m_applyFunctions && header.functionStartsPresent)
 		{
 			auto targetPlatform = m_view->GetDefaultPlatform();
+			auto arch = targetPlatform->GetArchitecture();
 			auto functions = header.ReadFunctionTable(*m_vm);
 			for (const auto& func : functions)
-				m_view->AddFunctionForAnalysis(targetPlatform, func, false);
+			{
+				uint8_t opcode[BN_MAX_INSTRUCTION_LENGTH];
+				size_t opLen = arch->GetMaxInstructionLength();
+				try
+				{
+					m_vm->Read(opcode, func, opLen);
+				}
+				catch (const std::exception& e)
+				{
+					m_logger->LogWarnF("Failed to read function start at {:#x}: {}", func, e.what());
+					continue;
+				}
+				if (IsValidFunctionStart(arch, func, opcode, opLen))
+					m_view->AddFunctionForAnalysis(targetPlatform, func, false);
+			}
 		}
 
 		BulkSymbolModification bulkSymbolModification(m_view);