0

I'm currently analyzing a function that has a lot of indirect jumps looking like the following.

LEA R10,[0x142000000]

(some instructions that dont change R10)

JMP R10

The Ghidra decompiler just treats the indirect jump as a call and doesnt give any meaningful output. How do I go ahead and analyze a function like that? I guess ideally I would just like to change the JMP R10 instruction to JMP 0x142000000 in this example, however if I cant just do that since the opcode is larger and other jumps would no longer align.

  • 1
    "and doesn't give any meaningful output" can you show what it actually produces in such case? – Paweł Łukasik Jan 13 at 15:42
  • @PawełŁukasik For the example it looks something like this void function(void) { /* WARNING: Treating indirect jump as call */ (*(code *)0x142000000)(); return; } if I go to the address it jumps it also only shows the same thing in the decompiler, so I think it realizes that its all 1 function – legendff Jan 13 at 18:27
0

You can potentially change this to what you're looking for by using the "Modify Instruction Flow..." menu item when right clicking the jump instruction.

In ghidra, press F1 and search for "Modify Instruction Flow" for a full description

  • Thank you, I'm only getting the option to modify instruction flow on the jump instructions, but it does seem todo what Im looking for. – legendff Jan 18 at 12:33
0

It looks like your program reads a function pointer from a global memory location, and then executing it. I can guess that the jump target isn't known at compile-time, but only on runtime.

*(code *)0x142000000)();

Means go to address 0x142000000, and treat its value as a function pointer, and call it. You can try to look for write references to 0x142000000 in your binary, trying to find which function pointer is written to that memory location.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.