non-matching standard archives carried over from other programs

[sollyucko]

Describe the bug In addition to the standard archive matching the program's platform and bitness, additional standard archives are sometimes open in the Data Type Manager.

To Reproduce Here's one way to reproduce it: Open a 64-bit Windows program and make sure windows_vs12_64 is open but not windows_vs12_64, then close the program. Import a new 32-bit Windows program, open it, and run Auto Analyze > Apply Data Archives. It should automatically open windows_vs12_32, and when I tested it, windows_vs12_64 was not open. Now close it and re-open the 64-bit Windows program. Both windows_vs12_32 (bad) and windows_vs12_64 (good) are now open.

Expected behavior The matching standard archive(s) should be automatically opened in the Data Type Manager (which does already happen), and any non-matching standard archives should be closed.

Screenshots

Attachments Relevant log portion from the test I did to reproduce the bug:

INFO	(ProgramDB) Updating language version for Program [...]: x86/little/32/default (Version 2.14
DEBUG	(ToolTaskManager) Background processing started...
DEBUG	(ToolTaskManager) Exec Task Auto Analysis
DEBUG	(PackedDatabaseCache) Using cached packed database: [...]\ghidra_10.3.3_PUBLIC_20230829\ghidra_10.3.3_PUBLIC\Ghidra\Features\Base\data\typeinfo\win32\windows_vs12_32.gdt
INFO	(ApplyDataArchiveAnalyzer) Applied data type archive: windows_vs12_32
INFO	(AutoAnalysisManager) -----------------------------------------------------
			      Apply Data Archives                        3.244 secs
			      -----------------------------------------------------
			      Total Time   3 secs
			      -----------------------------------------------------
			
DEBUG	(ToolTaskManager) Auto Analysis task finish (3.533 secs)
DEBUG	(ToolTaskManager) Queue - Auto Analysis
DEBUG	(ToolTaskManager) (0.0 secs)
DEBUG	(ToolTaskManager) Auto Analysis task complete (3.727 secs)
DEBUG	(ToolTaskManager) Background processing complete (3.729 secs)
DEBUG	(PackedDatabaseCache) Using cached packed database: [...]\ghidra_10.3.3_PUBLIC_20230829\ghidra_10.3.3_PUBLIC\Ghidra\Features\Base\data\typeinfo\win32\windows_vs12_32.gdt
DEBUG	(PackedDatabaseCache) Using cached packed database: [...]\ghidra_10.3.3_PUBLIC_20230829\ghidra_10.3.3_PUBLIC\Ghidra\Features\Base\data\typeinfo\win32\windows_vs12_64.gdt

Environment (please complete the following information):

• OS: Windows 10
• Java Version: 20.0.2
• Ghidra Version: 10.3.3 (probably also 10.0 and even older versions)
• Ghidra Origin: https://github.com/NationalSecurityAgency/ghidra/releases/download/Ghidra_10.3.3_build/ghidra_10.3.3_PUBLIC_20230829.zip

Additional context This results in a risk of accidentally selecting data types from the wrong archive, at best leading to needless type casting, and at worst having different layouts.

[dev747368]

First, the additional data type archives shown in the DT manager tree are configured at the code-browser tool level, and not the specific program that is focused in the tool (if you have multiple files open at the same time).

I too have noticed that the code browser will tend to accumulate dt archives over time, but I'd have to dig into the code to nail down why an auto-referenced archive is persisted in the config vs. just being listed 'transiently' for the life of the tool window.

I agree that having multiple versions of the same archive open at the same time can cause some confusion if the dt archive name isn't carefully watched when choosing a data type from a list, but having a common pool of data types / archives for all programs open in the tool is working as designed.

[sollyucko]

Got it, thanks. However, I pretty much always (including when i reproduced this) open each program in a separate instance of the code browser tool. Is this due to the tool's state automatically getting saved when I close it?

[ghidra1]

As archives are open within a tool they will be remembered when the tool is closed. Archives are not automatically forgotten by the tool. In addtion, when a type is pulled from an archive into a program and an association maintained, that archive will be opened in the tool when the program is opened. It will remain open when the program is closed. This is what can cause open archives to accumulate within a tool. Some archives will open automatically when a relavent analyzer opens an archive if the DataTypeManagerService is used to do so. Manually closing unwanted archives is generally recommended.