Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BSim: Get "cannot find remote function" error when applying changes #7897

Open
alexdevsec opened this issue Mar 11, 2025 · 4 comments
Open
Assignees
Labels
Feature: BSim Status: Prioritize This is currently being prioritized

Comments

@alexdevsec
Copy link

Describe the bug

When trying to match symbols with BSIM with dynamic libraries, the search function finds matches but both "Apply" functions and "Compare Functions" produce this kind of error:

Couldn't find remote function at address at xxxxxxx in remote program xxxxxx

To Reproduce
Steps to reproduce the behavior:
A. Create new BSim db from a dynamic library

  1. Compile a dynamic library from source (like libcurl.4.8.0.dylib)
  2. Create a new BSIM H2 db, following "BSim Search" section in the docs
  3. Ingest new dynamic library using AddProgramToH2BsimDatabaseScript.java

B. Do a search

  1. Open an existing application that has already been analyzed
  2. Follow instructions to connect to the above Bsim database
  3. Run BSim overview query (using "BSim Search Overview" section in docs)
  4. Right click on a match, which brings up the Bsim search results dialog
  5. Right click and select "Add Signature and Data Types". Get this error:

Couldn't find remote function at address at xxxxxxx in remote program xxxxxx

You also get the same thing if you right click and select "Compare Functions".

Screenshots

If applicable, add screenshots to help explain your problem.

Attachments
If applicable, please attach any files that caused problems or log files generated by the software.

Environment (please complete the following information):
MacOS 15.3.1
Java 23.0.1
Ghidra Version: 13.2.1
Ghidra Origin: Official download

Additional context

Matches between applications seems to work.

Image
Image

@ghidracadabra ghidracadabra self-assigned this Mar 11, 2025
@ghidracadabra ghidracadabra added the Status: Triage Information is being gathered label Mar 11, 2025
@ghidracadabra
Copy link
Contributor

Try saving libcurl.4.8.0.dylib in Ghidra after you analyze it but before you try to access it via Compare Functions or an apply action. My guess is that when Ghidra tries to open the remote program the analysis (and that function) hasn't been saved to the program yet.

I admit this is a little confusing since you are probably looking at that function in another tab.

@ghidracadabra ghidracadabra added Status: Waiting on customer Waiting for customer feedback and removed Status: Triage Information is being gathered labels Mar 11, 2025
@alexdevsec
Copy link
Author

Okay, so here's what I did:

  • open lib curl.4.8.0.dylib again
  • it goes through all the decompiling again
  • File->Save All
  • redid the BSim->Perform Overview...
  • picked an obvious match match with a 1.0 probability
  • the Compare Functions still fails...

@ghidracadabra
Copy link
Contributor

To help troubleshoot, would you try analyzing libcurl, saving it, closing Ghidra, then re-opening and performing the query?

The only way I've been able to reproduce what you're seeing is to save libcurl (but not exit Ghidra) after I've already gotten the "cannot find remote function" error. In that case I think the second query is using a cached version of libcurl from before the save.

@alexdevsec
Copy link
Author

Okay, now it works.

This is what I did, specifically in this order:

  • open Ghidra
  • open libcurl, analyze it
  • open my application
  • do bsim queries... and Compare and Apply all work

It does seem like there's something off with caching. Thanks for your help on this!

@ghidracadabra ghidracadabra added Status: Prioritize This is currently being prioritized and removed Status: Waiting on customer Waiting for customer feedback labels Mar 12, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Feature: BSim Status: Prioritize This is currently being prioritized
Projects
None yet
Development

No branches or pull requests

3 participants