-1

When disassembling ARM binaries in Ghidra, I often see these warnings:

                /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
                /* WARNING: Treating indirect jump as call */

What do they mean? What's the underlying architectural concept I should learn about to understand the cause of these issues?

Here's an example from a real program, seen in Ghidra's disassembly:

    if (param_2 == 0x78) {
                /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
                /* WARNING: Treating indirect jump as call */
      uVar3 = (*DAT_0747c19c)();
      return uVar3;
    }
4

From Ghidra.re:

Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable

For your example, this is saying there may a jump table (which is really just an array of pointers), but the decompiler can't figure out what the different possibilities for param2 are.

Ghidra recommends:

In such cases, you can add the jump targets manually and then run the script SwitchOverride.java. Note: To find such locations in a program, run the script FindUnrecoveredSwitchesScript.java.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.