NationalSecurityAgency / ghidra

Ghidra is a software reverse engineering (SRE) framework
https://www.nsa.gov/ghidra
Apache License 2.0
52.27k stars 5.92k forks source link

When the first function is passed as an argument of external function call, ghidra shows "0x100000" instead of the function argument names. #6930

Open Muqi-Zou opened 2 months ago

Muqi-Zou commented 2 months ago

image As shown in the picture, the evhttp_write_cb with function entry address "0x100000" is passed as an argument for external function call bufferevent_setcb. However, the decompiled code shows the function as a number "0x100000" instead of function name. Once the entry address of evhttp_write_cb changed, the argument shows correctly as below: image Since the p-code interface correctly shows the function name, I personally think (have not checked, and may be wrong) this is because of some implementation error among the boundary examination, probably related to the "addrforce" in varnode.hh or printing system like (printc.cc).

Muqi-Zou commented 2 months ago

libevent_http_o_Oall.zip here is the binary