TransWikia.com

What do these 2 Ghidra warnings mean?

Reverse Engineering Asked by adg on November 27, 2020

When disassembling ARM binaries in Ghidra, I often see these warnings:

                /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
                /* WARNING: Treating indirect jump as call */

What do they mean? What’s the underlying architectural concept I should learn about to understand the cause of these issues?

Here’s an example from a real program, seen in Ghidra’s disassembly:

    if (param_2 == 0x78) {
                /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
                /* WARNING: Treating indirect jump as call */
      uVar3 = (*DAT_0747c19c)();
      return uVar3;
    }

One Answer

From Ghidra.re:

Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable

For your example, this is saying there may a jump table (which is really just an array of pointers), but the decompiler can't figure out what the different possibilities for param2 are.

Ghidra recommends:

In such cases, you can add the jump targets manually and then run the script SwitchOverride.java. Note: To find such locations in a program, run the script FindUnrecoveredSwitchesScript.java.

Answered by Shane Reilly on November 27, 2020

Add your own answers!

Ask a Question

Get help from others!

© 2024 TransWikia.com. All rights reserved. Sites we Love: PCI Database, UKBizDB, Menu Kuliner, Sharing RPP