Ghidra not decompiling very simple ARM64 program

Question

I'm trying to learn how Ghidra works by using it to analyze a very simple ELF file written in Assembly, compiled on a raspberry pi 4 (ARM64)

My Assembly code looks like this:

.global _start

_start:
    mov x0, #0x1
    ldr x1, =helloworld
    mov x2, #0xb
    mov x8, #0x40
    svc 0

    mov x0, #0x0
    mov x8, #93
    svc 0

.data
helloworld: .ascii "Hello World"

I am compiling it like this:

$ as -o hello.o hello.s
$ ld -o hello hello.o

It is producing this executable:

$ file hello
hello: ELF 64-bit LSB executable, ARM aarch64, version 1 (SYSV), statically linked, not stripped

It runs just fine:

$ ./hello
Hello World

Now I am taking this ELF file and throwing it in to Ghidra and analyzing it and I'm getting an error. As shown below, there is nothing in the decompiled window, and in the bookmark window it shows:

Bad Instruction: Unable to resolve constructor at ..

I was hoping someone could spot what I'm doing wrong because this seems like it would be very straightforward.

Answer 1

Ghidra can't know what parameters the supervisor call is using. it only know that it is supervisor call 0. all other register loading and setting are ignored in the decompiler, because it can't connect them to anything.

after that, it reach PTR_hello_world, and surprised to find that it is not code. because there is nothing to stop it from disassmbling. (such as a ret instruction) so it complain about bad instruction. that give you the red x on the left, the "bad instruction" on the bottom right, and "halt_baddata" in the decompiler.