0

I'm currently analyzing a function that has a lot of indirect jumps looking like the following.

LEA R10,[0x142000000]

(some instructions that dont change R10)

JMP R10

The Ghidra decompiler just treats the indirect jump as a call and doesnt give any meaningful output. How do I go ahead and analyze a function like that? I guess ideally I would just like to change the JMP R10 instruction to JMP 0x142000000 in this example, however if I cant just do that since the opcode is larger and other jumps would no longer align.

Improve this question
2
  • 1
    "and doesn't give any meaningful output" can you show what it actually produces in such case?
    – Paweł Łukasik
    Jan 13, 2020 at 15:42
  • @PawełŁukasik For the example it looks something like this void function(void) { /* WARNING: Treating indirect jump as call */ (*(code *)0x142000000)(); return; } if I go to the address it jumps it also only shows the same thing in the decompiler, so I think it realizes that its all 1 function
    – legendff
    Jan 13, 2020 at 18:27

3 Answers 3

Reset to default
0

You can potentially change this to what you're looking for by using the "Modify Instruction Flow..." menu item when right clicking the jump instruction.

In ghidra, press F1 and search for "Modify Instruction Flow" for a full description

Improve this answer
1
  • Thank you, I'm only getting the option to modify instruction flow on the jump instructions, but it does seem todo what Im looking for.
    – legendff
    Jan 18, 2020 at 12:33
1

It looks like your program reads a function pointer from a global memory location, and then executing it. I can guess that the jump target isn't known at compile-time, but only on runtime.

*(code *)0x142000000)();

Means go to address 0x142000000, and treat its value as a function pointer, and call it. You can try to look for write references to 0x142000000 in your binary, trying to find which function pointer is written to that memory location.

Improve this answer
1

Its been a couple months since this was asked, but there is also another option. If you can manually calculate the jumps then its possible to specify these into Ghidra to override its default behaviour.

There is a script called SwitchOverride, which can be found in the script manager window. Below is the documentation from the script:

This script allows the user to manually specify the destinations of an indirect jump (switch)  to the decompiler, if it can't figure out the destinations itself or does so incorrectly.  To use, create a selection that contains:  the (one) instruction performing the indirect jump to override  other instructions whose addresses are interpreted as destinations of the switch  then run this script

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.