Skip to content

fix(tools/reversing): correct Ghidra recon script entry-point handling#395

Closed
VoidChecksum wants to merge 1 commit into
mainfrom
fix/reversing-ghidra-entrypoint
Closed

fix(tools/reversing): correct Ghidra recon script entry-point handling#395
VoidChecksum wants to merge 1 commit into
mainfrom
fix/reversing-ghidra-entrypoint

Conversation

@VoidChecksum
Copy link
Copy Markdown
Collaborator

Defect

_GHIDRA_RECON (in scripts.py line 35) contained:

addrs = [str(a) for a in f.getEntryPoint()]

Function.getEntryPoint() returns a single ghidra.program.model.address.Address object, which is not iterable. In Jython this raises TypeError: 'GenericAddress' object is not iterable the first time a real (non-thunk, non-external) function is visited, aborting the entire generated recon script before it can print any function list or imports.

The addrs variable was also never referenced anywhere else, making the line purely dead-then-crash code.

Impact

The bin_ghidra_script @tool emits this script body for the agent to write to disk and execute via analyzeHeadless. Any RE workflow invoking the standard Ghidra recon script produces a runtime crash with no function output.

Fix

Deleted the broken unused line. getEntryPoint() is already printed correctly on the immediately following print(...) line — no functional change needed, just removal.

Regression Test

packages/decepticon/tests/unit/reversing/test_ghidra_script_entrypoint.py — 4 new assertions:

  • test_no_iterable_getentrypoint: asserts the broken for a in f.getEntryPoint() pattern is absent (FAIL without fix, PASS with fix)
  • test_addrs_variable_absent: asserts addrs is not in the generated script (FAIL without fix, PASS with fix)
  • test_entrypoint_printed_once: asserts getEntryPoint() appears exactly once — the correct print call (FAIL without fix due to duplicate, PASS with fix)
  • test_binary_path_substituted: sanity-checks binary path substitution works

Remove the broken `addrs = [str(a) for a in f.getEntryPoint()]` line
in _GHIDRA_RECON: Address is not iterable in Jython, causing TypeError
on the first real function visit and aborting the recon script before
any output. The variable was also never used. getEntryPoint() is already
printed correctly on the next line.

Regression test: test_ghidra_script_entrypoint.py asserts the broken
iteration and unused addrs variable are absent, and that getEntryPoint()
appears exactly once per the correct print statement.
VoidChecksum added a commit that referenced this pull request May 30, 2026
…cript

Folds in the crash fix from #395: the Ghidra recon template iterated 'for a in f.getEntryPoint()', but Function.getEntryPoint() returns a single non-iterable Address, so the generated script raised at runtime. The line was also dead (addrs unused). Removes it; the entry point is still printed. Adds a regression test. Consolidates #395 into this PR.
@VoidChecksum
Copy link
Copy Markdown
Collaborator Author

Closing as a duplicate. The Ghidra recon-script getEntryPoint crash fix has been folded into #422 (which also tolerates extra Ghidra fields and makes the script templates brace-safe). Merge #422 instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant