Resolve direct ObjectPool Code targets

doc/learn.md

@@ -1976,3 +1976,28 @@ in the shared resolver enables field labels on iOS as well as compressed
 Android snapshots and replaces duplicate ROData loading in value graphs and
 string collection. Regression fixtures cover both platforms, patched and
 cyclic owners, missing names/owners, and deobfuscation.
+
+## Direct Code pool references use Code allocation indices
+
+ObjectPool resolution recognized Code objects but only assigned a target index
+for Function references. Code-slot loads and indirect calls therefore had a
+`code` annotation without a navigable instruction target.
+
+The main Code allocation range has the same order as the Code-backed part of
+the InstructionTable. Its zero-based index is `ref - cluster.start_ref`, which
+matches `DartInstructionTableEntry.code_index`; the table extractor handles
+`first_entry_with_code` when mapping that index to a payload address. Do not
+reuse the serialized Function index here: that index is biased by one and
+refers to the whole table. Deferred Code objects follow the main allocation
+range but have no instructions in this loading unit, so they keep an unresolved
+target. A discarded record in older Code clusters still occupies its ordinal.
+
+On Android w0rdle, `PP+0x40` holds ref 33249 in the Code cluster starting at
+22433, so it resolves to index 10816 and table address `0x3f1074`. Analysis now
+adds a CALL xref from `blr x0` at `0x3f28cc`, preserving the PP association
+through the Code entry-point load. `PP+0x48` resolves to the following index.
+On iOS AuthPass, `PP+0x68` holds ref 168520 in the Code cluster starting at
+132121, yielding index 36399 and table address `0x6d9620`. The synthetic
+regression checks index zero, a discarded record, the following main record,
+and an unresolved deferred record. These targets use the existing table
+payload-address convention described above.

src/lib/dart_pool_modern.c

@@ -2336,6 +2336,15 @@ static void modern_ref_resolver_resolve(ModernRefResolver *resolver, const Moder
 		}
 		return;
 	}
+	if (!strcmp (resolved->kind, "code")) {
+		// Instruction-table code indices follow the main Code allocation order.
+		// Deferred objects have no instructions in this loading unit's table.
+		ut64 index = ref - meta->start_ref;
+		if (index < meta->main_count) {
+			resolved->code_index = index;
+		}
+		return;
+	}
 	const ModernRefNameMap names = {
 		.strings_by_ref = resolver->strings_by_ref,
 		.class_name_ref = resolver->class_name_ref,

test/db/cmd/pp-code-resolve-android

@@ -0,0 +1,25 @@
+NAME=pp-code-resolve-android
+FILE=bins/android/w0rdle/libapp.so
+ARGS=-NN -e scr.color=0 -e bin.relocs.apply=true
+CMDS=<<EOF
+L ../src/r2/core_flutter.so
+L ../src/r2/core_flutter.dylib
+r2flutter -q -j -O pp+0x40~{pp_slot.resolved_kind}
+r2flutter -q -j -O pp+0x40~{pp_slot.resolved_code_index}
+r2flutter -q -j -O pp+0x48~{pp_slot.resolved_code_index}
+r2flutter -q -j -HHH -l 500~{snapshots[1].clusters[365].object_pools[0].entries[6].resolved_code_index}
+r2flutter -q -AAA
+CC. @ 0x3f28cc
+axfj @ 0x3f28cc~{[0].to}
+axfj @ 0x3f28cc~{[0].type}
+EOF
+EXPECT=<<EOF
+code
+10816
+10817
+10816
+dart: indirect call via PP+0x40 code method.fn_10816
+4132980
+CALL
+EOF
+RUN

test/db/cmd/pp-code-resolve-ios

@@ -0,0 +1,18 @@
+NAME=pp-code-resolve-ios
+FILE=bins/ios/AuthPass.app/Frameworks/App.framework/App
+ARGS=-NN -e scr.color=0 -e bin.relocs.apply=true
+CMDS=<<EOF
+L ../src/r2/core_flutter.so
+L ../src/r2/core_flutter.dylib
+r2flutter -q -j -O pp+0x68~{pp_slot.resolved_kind}
+r2flutter -q -j -O pp+0x68~{pp_slot.resolved_code_index}
+r2flutter -q -j -O pp+0x70~{pp_slot.resolved_code_index}
+r2flutter -q -j -HHH -l 1100~{snapshots[1].clusters[1028].object_pools[0].entries[11].resolved_code_index}
+EOF
+EXPECT=<<EOF
+code
+36399
+36400
+36399
+EOF
+RUN

test/db/cmd/pp-code-resolve-synthetic

@@ -0,0 +1,23 @@
+NAME=pp-code-resolve-main-discarded-and-deferred
+FILE=malloc://0x8c
+CMDS=<<EOF
+L ../src/r2/core_flutter.so
+L ../src/r2/core_flutter.dylib
+# Main Code refs include a discarded entry; the last Code is deferred.
+wx 50414421f5f5dcdc84000000000000000200000000000000333063303531636239313932663664363831326265336630623837613633353670726f647563742061726d363420636f6d707265737365642d706f696e746572730082878283800040c483c0c8c081c00060c5818480808080808080808080808080808080808080808080841183118411851186
+r2flutter -q -j -O pp+0x10~{pp_slot.resolved_kind}
+r2flutter -q -j -O pp+0x10~{pp_slot.resolved_code_index}
+r2flutter -q -j -O pp+0x18~{pp_slot.resolved_code_index}
+r2flutter -q -j -O pp+0x20~{pp_slot.resolved_code_index}
+r2flutter -q -j -O pp+0x28~{pp_slot.resolved_kind}
+r2flutter -q -j -O pp+0x28~{=}~resolved_code_index~?
+EOF
+EXPECT=<<EOF
+code
+0
+1
+2
+code
+0
+EOF
+RUN