How to programmatically get an undefined function at an address? #7896

bukowa · 2025-03-10T23:45:52Z

bukowa
Mar 10, 2025

I'm trying to retrieve a function at a specific address in Ghidra, but getFunctionAt(addr) returns None when the function is undefined. However, the decompiler still produces output for it.

Is there a way to programmatically retrieve or treat an undefined function at an address as a function? Ideally, I'd like to decompile it:

Here's my hacked script:

import re
from time import sleep
import ghidra

def collect_and_print_matches():
    pattern = r'L"([^"]+)"'  # Regex to capture wide string literals

    refs = getReferencesTo(toAddr(0x112A7EB0))
    decomp = ghidra.app.decompiler.DecompInterface()
    decomp.openProgram(currentProgram)
    valid_function_count = 0  # Counter for valid functions

    for ref in refs:
        func = getFunctionContaining(ref.getFromAddress())

        if not func:
            # ???
        else:
            decomp_results = decomp.decompileFunction(func, 30, monitor)

            if decomp_results.decompileCompleted():
                fn_code = decomp_results.getDecompiledFunction().getC()
                matches = re.findall(pattern, fn_code)