search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
52.25k stars 5.92k forks source link

Function Call Graph hang #192

Closed rogerclarkmelbourne closed 3 years ago

rogerclarkmelbourne commented 5 years ago

Describe the bug The Function Call Graph tool hung, causing all Ghidra windows to be unusable, and the Ghidra process / application had to be terminated using the Windows task manager

To Reproduce Select a function in the disassembly view Click on each node in the Function Call Graph tool, and then click on the "+" icon to expand both the parents and children of each node. Repeat until no more related nodes (functions) are found.

Note. This is probably dependent on the function hierarchy. I have done the same process on various function groups, and is not hung, but one function group did hang.

Expected behavior Its not supposed to hang.

Screenshots Sorry, too late. I will screenshot again when it happens again, however I'm going to try to avoid doing this again, as I loose any unsaved changes.

Attachments Sorry I can't attach the binary file that caused this, for legal reasons. Though I can share it privately

Environment (please complete the following information):

Additional context

I'm reverse engineering an ARM binary, running on a NXP MK22 MCU. The application binary was compiled using IAR, using the NXP SDK and the MQX RTOS

dragonmacher commented 5 years ago

It sounds like you have encountered a degenerate case in which the node you expanded has an extremely large number of edges. If you encounter this again, please let us know how many references there were to the node you were expanding. If you were expanding the outgoing node, then this would be all functions called by the clicked node; if you were expanding an incoming node, then this would be all functions that call the clicked node. You can use the Function Call Trees provider to gain this information without locking the UI, as the Function Call Trees provider uses a background thread to load its data.

This feature is nascent, likely to encounter issues such as this. Bug reports and usability suggestions are welcomed.

rogerclarkmelbourne commented 5 years ago

OK. Thanks.

BTW. I found someone had posted the binary.

https://github.com/forkoz/GD-77/blob/master/GD-77_firmware_decrypt_encrypt_workdir/GD-77_V3.1.8_0CD1_077001.dec

The file is a binary, despite its file extension. Its ARM Cortex Little-endian. offset 0x4000 (Processor is actually a NXP MK22 but ARM Cortex is the same)

I've realized that Ghidra generally seems to have problems finding all the function xrefs (using the default analysis settings) and hence the code appears to have a lot of orphaned functions, which is not the case.

I looked at the analysis settings, but I can't see anything in the "prototype" options which would improve this situation.

Perhaps I should create another issue about the missing function XRefs

dragonmacher commented 3 years ago

Closing this for now due to inactivity.