ghidra icon indicating copy to clipboard operation
ghidra copied to clipboard

Decompiler exception in x86 code (regression)

Open sev- opened this issue 1 year ago • 6 comments

Describe the bug Decompiler crashes when attempting to process one particular function. Happened between 10.3 and 10.3.3, still present in 10.4

To Reproduce

  1. Create new project

  2. Import the attached file (rename it to MAPNAV.DLL), it is a 16-bit NE executable. MAPNAV.DLL

  3. Start Ghidra and run autoanalysis with default parameters

  4. Navigate to _MAPNAV_MNEW function in Exports

  5. The decompiler window shows:

Exception while decompiling 1008:0041: Decompiler process died

Expected behavior In Ghidra 10.3 (May 10) the function is being decompiled

undefined4 __stdcall16far
_MAPNAV_MNEW(undefined2 param_1,undefined2 param_2,undefined4 param_3,undefined2 param_4,
            undefined2 param_5)

{
  code **ppcVar1;
  int iVar2;
  undefined2 uVar3;
  undefined2 uVar4;

Attachments MAPNAV.DLL (20 kb)

Environment (please complete the following information):

  • OS: macOS 14.1 Sonoma
  • Java Version: 21.0.1
  • Ghidra Version: 10.3.3 and later
  • Ghidra Origin: official GitHub distro

Additional context Add any other context about the problem here.

sev- avatar Dec 19 '23 12:12 sev-

Not sure why but I cannot download your attachment.

ryanmkurtz avatar Dec 19 '23 14:12 ryanmkurtz

As I mentioned, you have to rename it. Download it as a blob, because I had to add .png extension to it due to limitation of GitHub which whitelists acceptable file names.

E.g. right click, save as, name it "MAPNAV.DLL"

sev- avatar Dec 19 '23 14:12 sev-

Issue is still present in the master branch.

ryanmkurtz avatar Dec 19 '23 15:12 ryanmkurtz

Regarding

Navigate to _MAPNAV_NEW function in Exports

there is no such API, did you mean _MAPNAV_MNEW ?

image

greenozon avatar Dec 22 '23 07:12 greenozon

Yes, it was a typo. Shown correctly on the 10.3 decompiler output, though

sev- avatar Dec 22 '23 11:12 sev-

the freshly baked version 11.0 still has this bug:

image

greenozon avatar Dec 23 '23 10:12 greenozon