NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
50.42k stars 5.76k forks source link

jython fails to correctly get function information on ARM binaries #6725

Closed trashcanna closed 1 month ago

trashcanna commented 1 month ago

Describe the bug When calling get methonds on a function from an arm binary, the return values of those methods are incorrect. Examples below better describe the behavior.

To Reproduce In an ARM database:

addr = address_of_valid_function
fm = currentProgram.getFunctionManager()
f = fm.getFunction(toAddr(addr))
return_type = f.getReturnType() # Will always return undefined, even in cases it is created
calling_convention = f.getCallingConvention() # Will always return none, even in cases there is a calling convention

f.getName() is the only case I've had function as intended, all other get methods fail

I have not been able to replicate this problem with x86 binaries. Expected behavior Expected script output to match what is shown in gui

Screenshots image

image

Attachments httpd.zip

Environment (please complete the following information):

Additional context Add any other context about the problem here.

ryanmkurtz commented 1 month ago

Might be an issue with jarray? If you don't figure it out I can play with it tomorrow:

https://www.jython.org/jython-old-sites/archive/22/userguide.html#java-arrays

trashcanna commented 1 month ago

That array index out of bounds isn't the issue, just a result of it (you'd expect to be able to index into that array because there is a parameter to this function), I think it's some other underlying issue (because the ReturnType, CallingConvention, and Parameters all return [presumably] the default values

ryanmkurtz commented 1 month ago

What happens if you right click on your function signature in the Decompiler and then do Commit Params/Return? My return type in the Listing was undefined until I did this.

trashcanna commented 1 month ago

That seems to have worked, is there a way to do that for every function in the binary without the GUI interaction?

ryanmkurtz commented 1 month ago

See the discussion in #4640 for more info.

Theoretically you can do this by running the "Decompiler Parameter ID" analyzer.