Renaming a function globally

Question

I have decompiled a DLL, and in the Symbol tree, I have clicked a function. This function looks like this in the Decompile window:

undefined4 process_something(undefined4 param_1,undefined4 param_2)
{
      thunk_FUN_1017e9e0(param_1,param_2);
      return 0;
}

I have right-clicked on FUN_1017e9e0, then I selected "Rename Function". I have renamed it "process_something_internal", and "Namespace" was set to Global.

Now the function looks like this:

undefined4 process_something(undefined4 param_1,undefined4 param_2)
{
      process_something_internal1(param_1,param_2);
      return 0;
}

However, when I double click "process_something_internal1", it takes me to the function:

void FUN_1017e9e0(undefined4 param_1,undefined4 param_2)
{
    //do something
    return;
 }

Why has the function not be renamed as well?

Thank you!

Answer 1

You renamed a thunk ("thunk_FUN_1017e9e0"). That thunk points to the function "FUN_1017e9e0". When you double-click on the thunk, Ghidra is bypassing it and taking you directly to the thunked function.

In the Ghidra symbol table, you should see 2 separate entries for "process_something_internal1" (thunk) and "FUN_1017e9e0" (thunked function).

Answer 2

This function has already been loaded and therefore it is in memory. When you override it's name the memory reference is still the same.