-1

I have been using Ghidra to decompile a library. When I analyzed the decompiled version of a function, it resulted in this following output.

{
                    /* WARNING: Treating indirect jump as call */
  (*(code *)0x1b8318)();
  return;
}

I did some more digging and found that most functions lead back to the same thing with the same message. I did some research online and found a solution where I should change the value stored at the address (0x1b8318) to a function pointer. Would this work?

1 Answer 1

1

goto the address, press d to decompile. if it looks like sensible code, then press F to make it a function. This is common for function pointers, windows COM, callbacks etc.

If your on an embedded system, you might need to check your memory map to tell the compiler to look in the correct regions of memory to find code. For example the call could be from application to firmware for example.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.