search

NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
51.12k stars 5.82k forks source link

An unexpected error occured while processing the command: Auto Analysis #2673

Closed vanhauser-thc closed 3 years ago

vanhauser-thc commented 3 years ago

Describe the bug When auto analyzing an aarch64 linux binary I receive an exception for demangling and the process aborts. Issue seems to be a bug in identifying the type of a mangled object.

To Reproduce

  1. Click Analysis
  2. Click Auto Analyse
  3. Click Analyse

Expected behavior Auto Analysis runs though without issues.

Screenshots

'ghidra.app.util.demangler.DemangledType ghidra.app.util.demangler.DemangledObject.getNamespace()'
java.lang.NoSuchMethodError: 'ghidra.app.util.demangler.DemangledType ghidra.app.util.demangler.DemangledObject.getNamespace()'
    at ghidra.app.cmd.data.rtti.gcc.TypeInfoUtils.getDemangledType(TypeInfoUtils.java:286)
    at ghidra.app.cmd.data.rtti.gcc.TypeInfoUtils.getNamespaceFromTypeName(TypeInfoUtils.java:270)
    at ghidra.app.plugin.prototype.GccRttiAnalyzer.applyTypeInfoTypes(GccRttiAnalyzer.java:348)
    at ghidra.app.plugin.prototype.GccRttiAnalyzer.added(GccRttiAnalyzer.java:147)
    at ghidra.app.plugin.core.analysis.AnalysisScheduler.runAnalyzer(AnalysisScheduler.java:186)
    at ghidra.app.plugin.core.analysis.AnalysisTask.applyTo(AnalysisTask.java:39)
    at ghidra.app.plugin.core.analysis.AutoAnalysisManager$AnalysisTaskWrapper.run(AutoAnalysisManager.java:688)
    at ghidra.app.plugin.core.analysis.AutoAnalysisManager.startAnalysis(AutoAnalysisManager.java:788)
    at ghidra.app.plugin.core.analysis.AutoAnalysisManager.startAnalysis(AutoAnalysisManager.java:667)
    at ghidra.app.plugin.core.analysis.AutoAnalysisManager.startAnalysis(AutoAnalysisManager.java:632)
    at ghidra.app.plugin.core.analysis.AnalysisBackgroundCommand.applyTo(AnalysisBackgroundCommand.java:58)
    at ghidra.framework.plugintool.mgr.BackgroundCommandTask.run(BackgroundCommandTask.java:102)
    at ghidra.framework.plugintool.mgr.ToolTaskManager.run(ToolTaskManager.java:315)
    at java.base/java.lang.Thread.run(Thread.java:834)

Attachments I cannot reveal the program where this happens ... :(

Environment (please complete the following information): Build Date: 2020-Dec-29 1701 EST Ghidra Version: 9.2.2 Java Home: /usr/lib/jvm/java-11-openjdk-amd64 JVM Version: Debian 11.0.10-ea OS: Linux 5.9.0-kali5-amd64 amd64 Workstation: localhost

vanhauser-thc commented 3 years ago

This happens if either the feature "GCC C++ Class Analyzer (Prototype)" or "GCC RTTI Analyzer (Prototype)" are activated. Are they include and active by default? or is that a plugin I installed and blindly forward copied to the new ghidra version?

dragonmacher commented 3 years ago

or is that a plugin I installed and blindly forward copied to the new ghidra version?

This is likely the issue. There should be no java.lang.NoSuchMethodErrors happening in a build of Ghidra. The old plugin is calling a method that has been changed or removed. If you have the source for the plugin, you should be able to load it into the dev environment and see the compile issues.