Follow

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use
Contact

Ghidra decompile windows is greyed backgound

For some methods, Ghidra’s decompiler background window is greyed out and I can’t rename the function nor the local variables.
Why?

It works fine for methods with a "white background".

Example:

MEDevel.com: Open-source for Healthcare and Education

Collecting and validating open-source software for healthcare, education, enterprise, development, medical imaging, medical records, and digital pathology.

Visit Medevel

Decompile window is greyed out

Matching code

        004d49dd cc              ??         CCh
        004d49de cc              ??         CCh
        004d49df cc              ??         CCh
                             LAB_004d49e0                                    XREF[1]:     FUN_004d4ac0:004d4b0e(*)  
  ==>   004d49e0 64 8b 0d        MOV        ECX,dword ptr FS:[0x2c]
                 2c 00 00 00
        004d49e7 a1 bc 39        MOV        EAX,[DAT_00d439bc]                               = ??
                 d4 00
        004d49ec 8b 14 81        MOV        EDX,dword ptr [ECX + EAX*0x4]
        004d49ef 8b 92 08        MOV        EDX,dword ptr [EDX + 0x8]
                 00 00 00

>Solution :

You can only do rename in a fully defined function. The grey background means that Ghidra didn’t properly create a function at this point. You can see this also in a disassembly where you only have a label at this location. If you think this is a function you can type F and define a function. It should enable all the edit options.

enter image description here

Add a comment

Leave a Reply

Keep Up to Date with the Most Important News

By pressing the Subscribe button, you confirm that you have read and are agreeing to our Privacy Policy and Terms of Use

Discover more from Dev solutions

Subscribe now to keep reading and get access to the full archive.

Continue reading