How to mark data as pointer to external functions in ghidra

Question

I'm examining a piece of malware with Ghidra, and like most malware it uses LoadLibrary and GetProcAddress to dynamically load libraries and functions. GetProcAddress stores the function addresses in an area of memory. I have figured out what functions are stored at what addresses and I would like ghidra to reflect this.

That is, i'd like it to say, for example, Call MPR.DLL::WNetOpen rather than Call qword ptr [some_address]. I kind of achieved this by going to the place where the address is stored and adding an external reference, however, this does not propagate the parameters of the reference, and in the disassembled view it looks different from an external function call that ghidra figured out at analysis time. Here are some pictures to help.

The first picture is an image of what I know to be LoadLibraryA through analysis. Notice I had to name it LoadLibraryB to avoid an error due to conflicting labels with the originally imported LoadLibraryA.

The second image is of the actual LoadLibraryA that was imported at the beginning of analysis, notice it has the correct parameters and return value.

I just want them to look the same.

Answer 1

You have a external reference (presumably created via right click > References > Add/Edit...) with LoadLibraryB, while the default imported LoadLibraryA is an external function. You can convert the location to a function. From the Ghidra Help Contents:

From either the Symbol Table or Symbol Tree, an existing External Location may be converted to a function using the Create External Function popup action on the selected node. The resulting External Function may be converted back to a simple External Location by deleting the function node. To really remove the function and its location will require a second delete on the External Location.

And the awkwardness of this seems to be acknowledged too:

Creating an External Reference is currently the only mechanism within the Ghidra GUI to establish an External Location. Once an External Location has been established, it can be converted to a function (see above). This limitation should hopefully be resolved in a future release of Ghidra.

So in summary: find the symbol in the symbol tree, right click > Create Function (F shortcut)