From 75815463ff7834bc1a601c2eac9fb23bb49aa50f Mon Sep 17 00:00:00 2001
From: tinysec <root@tinysec.net>
Date: Thu, 23 Jul 2026 03:09:37 +0800
Subject: [PATCH] Add derived string code references

---
 Function/BNGetDerivedStringCodeReferences.cs |  4 +-
 NavigationExtensions.cs                      | 49 ++++++++++++++++++++
 2 files changed, 51 insertions(+), 2 deletions(-)

diff --git a/Function/BNGetDerivedStringCodeReferences.cs b/Function/BNGetDerivedStringCodeReferences.cs
index efc0e502..4aec198d 100644
--- a/Function/BNGetDerivedStringCodeReferences.cs
+++ b/Function/BNGetDerivedStringCodeReferences.cs
@@ -25,10 +25,10 @@ internal static extern IntPtr BNGetDerivedStringCodeReferences(
 		    IntPtr str   , 
 			
 			// size_t* count
-		    IntPtr count   , 
+		    out UIntPtr count,
 			
 			// bool limit
-		    bool limit   , 
+		    [MarshalAs(UnmanagedType.I1)] bool limit,
 			
 			// size_t maxItems
 		    UIntPtr maxItems  
diff --git a/NavigationExtensions.cs b/NavigationExtensions.cs
index 727fb16e..88750710 100644
--- a/NavigationExtensions.cs
+++ b/NavigationExtensions.cs
@@ -516,6 +516,55 @@ public static DerivedString[] GetDerivedStrings(this BinaryView view)
             }
         }
 
+		/// <summary>
+		/// Returns code references associated with an analyzed derived string.
+		/// </summary>
+		public static ReferenceSource[] GetDerivedStringCodeReferences(
+			this BinaryView view,
+			DerivedString derivedString,
+			ulong? maxItems = null
+		)
+		{
+			if (null == view)
+			{
+				throw new ArgumentNullException(nameof(view));
+			}
+
+			if (null == derivedString)
+			{
+				throw new ArgumentNullException(nameof(derivedString));
+			}
+
+			BNDerivedString native = derivedString.ToNativeEx();
+			try
+			{
+				using (ScopedAllocator allocator = new ScopedAllocator())
+				{
+					IntPtr references = NativeMethods.BNGetDerivedStringCodeReferences(
+						view.DangerousGetHandle(),
+						allocator.AllocStruct(native),
+						out UIntPtr countValue,
+						maxItems.HasValue,
+						new UIntPtr(maxItems.GetValueOrDefault())
+					);
+
+					return UnsafeUtils.TakeStructArrayEx<BNReferenceSource, ReferenceSource>(
+						references,
+						countValue.ToUInt64(),
+						ReferenceSource.FromNative,
+						NativeMethods.BNFreeCodeReferences
+					);
+				}
+			}
+			finally
+			{
+				if (IntPtr.Zero != native.value)
+				{
+					NativeMethods.BNFreeStringRef(native.value);
+				}
+			}
+		}
+
         // Adapts BNFreeDerivedStringList (which takes a UIntPtr count) to the
         // Action<IntPtr, ulong> signature TakeStructArrayEx expects. Named method, not a
         // lambda, per the project's C# style rules.