In the Ghidra decompiler, after applying a type to a function parameter, the compiler uses that type information to provide better decompilation within the function. When that parameter is used in a function call though, the type information does not propagate. I have to manually change the function signature for the type information to carry forward.
Is there any way to get Ghidra to automatically propagate the type information? I thought Commit Params/Return P
or Commit Local Names
would do it, but no luck. Finding it time-consuming to have to re-type a known entity in every function call it's used.
Example:
Looking at a Windows Kernel Driver, following the analysis steps here
Changed the type of param_2 from longlong
to PIRP
and renamed it pIRP
. Then selected Analysis -> Auto-Analyze file.sys and only selected Decompiler Parameter ID.
After running the analysis, I'm left with this :
int FUN_140001a20(longlong test,PIRP pIRP)
{
... TRIMMED...
if (uVar2 == 0xc3500e68) {
uVar7 = FUN_140002a14(test,(longlong)pIRP,(longlong)pbVar3);
And double-clicking FUN_140002a14
:
void FUN_140002a14(longlong param_1,longlong param_2,longlong param_3)
For whatever reason, pIRP
's type is getting cast, and the signature for the called function doesn't change. I'd have expected the longlong
to become PIRP
.
Edit:
Still working this. Since the types/names don't propagate, working a script to do it for me for a given function. Right now I'm grabbing all functions called by a given function and trying to change a known parameter's name/type.
What I'm most confused about is in the Decompiler window, when I rename/retype a variable, it propagates through the rest of that function. But when I query the parameters for those functions, the variables are unchanged. For example, in the decompiler window, pIRP
is propagated to all functions where it's used, but when I get the function signatures in the script, it still has the name as param_2
.
Decompiler Window:
uVar5 = FUN_140002a14(param_1,(longlong)pIRP,(longlong)CurrentStackLocation)
Script Output:
helloGhidra.java> FUN_140002a14[[longlong param_1@RCX:8], [longlong param_2@RDX:8], [longlong param_3@R8:8]]
This occurs even if I try Commit Params/Return P and Commit Local Names for the parameter.