3

When disassembling ARM binaries in Ghidra, I often see these warnings:

                /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
                /* WARNING: Treating indirect jump as call */

What do they mean? What's the underlying architectural concept I should learn about to understand the cause of these issues?

Here's an example from a real program, seen in Ghidra's disassembly:

    if (param_2 == 0x78) {
                /* WARNING: Could not recover jumptable at 0x0747c198. Too many branches */
                /* WARNING: Treating indirect jump as call */
      uVar3 = (*DAT_0747c19c)();
      return uVar3;
    }

1 Answer 1

7

From Ghidra.re:

Sometimes you will see warnings in the decompiler view stating that there are too many branches to recover a jumptable. One reason for this is that there actually is a jump table, but the decompiler can’t determine bounds on the switch variable

For your example, this is saying there may a jump table (which is really just an array of pointers), but the decompiler can't figure out what the different possibilities for param2 are.

Ghidra recommends:

In such cases, you can add the jump targets manually and then run the script SwitchOverride.java. Note: To find such locations in a program, run the script FindUnrecoveredSwitchesScript.java.

1
  • I tried that but makes no difference. In my case, the template for at least some switches is (segmented Intel code): switch_table: array of (16b value, 16b code offset) switch_code: MOV SI,(#cases-1)*4 next_case: CMP AX, word ptr CS:[SI+switch_table] JNZ no_match JMP word ptr CS:[SI+switch_table+2] no_match: SUB SI,4 JNS next_case I selected the JMP instruction in disassembler, added the switch addresses manually with RE, ran the SwitchOverride.java code, recompiled the function. No difference. Well one difference, I do see the switch addresses in the function graph, so it does seem to have pi Commented Mar 21, 2022 at 20:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.