1

Of all the confusing parts of Ghidra, I'd like to ask about the "code" keyword. A similar question was asked here. However, I am not asking what the keyword is, but how to interpret/define this keyword.

In that post, it is said that this is a function pointer. And, from what I can tell in the example Ghidra gave below, that would make some sense (still trying to wrap my head around it). But how can I define "code" so that gcc will recognize it and have it work properly? Is there a general solution to this or must I decide case-by-case what to do? In another Ghidra project I'm figuring out, there are numerous examples of "code" appearing. I'm assuming I can't just replace it with any old data type? Unless...?

void FUN_00101020(void)
{
                    // WARNING: Treating indirect jump as call
  (*(code *)(undefined *)0x0)();
  return;
}

1 Answer 1

1

code is a generic term for an undefined function pointer. Ghidra's usage of assigning variables as code * is only produced through auto-analysis and not an exposed type for users. A generic void * or function definition should be used instead.

a function can be prototyped as below in a generic way

typedef returntype callingconvention functionname( {type of argument} argument1},..... )   

code represents this generic function pointer

typedef int __stdcall foo(int a,int b); is a specific function pointer

so if you understand or found that a specific area belongs to foo(....) then you can define it as such by setting the type of function.

then instead of (code *) ghidra should be able to infer the type and decompile the function as (*(foo *)) blah;

at least that is what is the expected behavior and this behavior again depends on several different heuristics.

in the snippet you posted there are several undefined..

ghidra doesn't know the function type nor its argument type and it cant find the pointer as well..

for example x=GetProcAddress(.....)
call x 

where x would be pointer to some dynamically obtained function from an arbitrarily loaded helper module

the arguments would be the prototype the author of the code provided when he coded the snippet

(*(code *)(undefined *)0x0)();

for example if the function was prototyped as

void __cdecl blah(char * first , w_char_t * second,.....)

then you can arbitrarily reverse it as

void __unknown code (void * myfirst, void * mysecond,....)

this is what is represented by code

2
  • Are the typedef's strictly necessary in this example? Also, I don't think I've ever seen the "calling convention" or "__stdcall" before, I'm sorry to say
    – Luke Dunn
    Jan 30 at 6:41
  • 1
    then you should try to see them. actively look for them and get yourself acquinted with them
    – blabb
    Jan 30 at 7:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.