1

I have decompiled a DLL, and in the Symbol tree, I have clicked a function. This function looks like this in the Decompile window:

undefined4 process_something(undefined4 param_1,undefined4 param_2)
{
      thunk_FUN_1017e9e0(param_1,param_2);
      return 0;
}

I have right-clicked on FUN_1017e9e0, then I selected "Rename Function". I have renamed it "process_something_internal", and "Namespace" was set to Global.

Now the function looks like this:

undefined4 process_something(undefined4 param_1,undefined4 param_2)
{
      process_something_internal1(param_1,param_2);
      return 0;
}

However, when I double click "process_something_internal1", it takes me to the function:

void FUN_1017e9e0(undefined4 param_1,undefined4 param_2)
{
    //do something
    return;
 }

Why has the function not be renamed as well?

Thank you!

2

You renamed a thunk ("thunk_FUN_1017e9e0"). That thunk points to the function "FUN_1017e9e0". When you double-click on the thunk, Ghidra is bypassing it and taking you directly to the thunked function.

In the Ghidra symbol table, you should see 2 separate entries for "process_something_internal1" (thunk) and "FUN_1017e9e0" (thunked function).

2
  • this sounds like the correct answer. The process_something_internal1 vs process_something_internal is semi-puzzling. – mumbel Jun 3 '20 at 22:29
  • I should've added the following from the "Functions" section in "Ghidra Help": Within the Code Browser, double-clicking on a thunk function name will navigate to the associated thunked function, while thunked functions will display back-references (i.e., XREFs) to the associated thunk functions with a Ref-Type of 'T'. – j-ratz Jun 3 '20 at 22:47
-1

This function has already been loaded and therefore it is in memory. When you override it's name the memory reference is still the same.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy