1

I have decompiled a DLL, and in the Symbol tree, I have clicked a function. This function looks like this in the Decompile window:

undefined4 process_something(undefined4 param_1,undefined4 param_2)
{
      thunk_FUN_1017e9e0(param_1,param_2);
      return 0;
}

I have right-clicked on FUN_1017e9e0, then I selected "Rename Function". I have renamed it "process_something_internal", and "Namespace" was set to Global.

Now the function looks like this:

undefined4 process_something(undefined4 param_1,undefined4 param_2)
{
      process_something_internal1(param_1,param_2);
      return 0;
}

However, when I double click "process_something_internal1", it takes me to the function:

void FUN_1017e9e0(undefined4 param_1,undefined4 param_2)
{
    //do something
    return;
 }

Why has the function not be renamed as well?

Thank you!

2

You renamed a thunk ("thunk_FUN_1017e9e0"). That thunk points to the function "FUN_1017e9e0". When you double-click on the thunk, Ghidra is bypassing it and taking you directly to the thunked function.

In the Ghidra symbol table, you should see 2 separate entries for "process_something_internal1" (thunk) and "FUN_1017e9e0" (thunked function).

| improve this answer | |
  • this sounds like the correct answer. The process_something_internal1 vs process_something_internal is semi-puzzling. – mumbel Jun 3 at 22:29
  • I should've added the following from the "Functions" section in "Ghidra Help": Within the Code Browser, double-clicking on a thunk function name will navigate to the associated thunked function, while thunked functions will display back-references (i.e., XREFs) to the associated thunk functions with a Ref-Type of 'T'. – j-ratz Jun 3 at 22:47
-1

This function has already been loaded and therefore it is in memory. When you override it's name the memory reference is still the same.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy