NationalSecurityAgency/ghidra · error · PcodeExecutionException

Callee at {target} is not a function.

Error message

Callee at {target} is not a function.

What it means

Thrown during symbolic p-code execution when a CALL operation's target address does not have a Function defined at it in the program's FunctionManager. The SymPcodeExecutor.executeCall() resolves the call target from the p-code op, looks up getFunctionAt(target), and throws PcodeExecutionException if null — meaning the call destination exists in memory but Ghidra has no function analysis there.

Source

Thrown at Ghidra/Debug/Debugger/src/main/java/ghidra/app/plugin/core/debug/stack/SymPcodeExecutor.java:150

		return extrapop;
	}

	/**
	 * Attempt to figure the stack depth change for a given function
	 * 
	 * @param callee the function being called
	 * @return the depth change, i.e., change to SP
	 */
	public int computeStackChange(Function callee) {
		return computeStackChange(callee, warnings);
	}

	@Override
	public void executeCall(PcodeOp op, PcodeFrame frame, PcodeUseropLibrary<Sym> library) {
		Address target = op.getInput(0).getAddress();
		Function callee = program.getFunctionManager().getFunctionAt(target);
		if (callee == null) {
			throw new PcodeExecutionException("Callee at " + target + " is not a function.", frame);
		}
		String fixupName = callee.getCallFixup();
		if (fixupName != null && !"".equals(fixupName)) {
			PcodeProgram snippet;
			try {
				snippet = PcodeProgram.fromInject(program, fixupName, InjectPayload.CALLFIXUP_TYPE);
				execute(snippet, library);
			}
			catch (MemoryAccessException | UnknownInstructionException | NotFoundException
					| IOException e) {
				throw new PcodeExecutionException("Issue executing callee fixup: ", e);
			}
			return;
		}
		int change = computeStackChange(callee);
		adjustStack(change);
	}

View on GitHub (pinned to d5f144c24d)

Solutions

1. Define a function at the call target address in the Ghidra listing (right-click > Create Function).
2. Run full auto-analysis on the program to populate the FunctionManager.
3. If the target is an external function, ensure the external location is properly resolved.
4. Check that the p-code op's input(0) address is correct and not corrupted by a bad disassembly.

Example fix

// Before: call target has no function — emulation throws.
// After: in Ghidra listing, navigate to target address and create function.
// Or programmatically:
// CreateFunctionCmd cmd = new CreateFunctionCmd(targetAddress);
// cmd.applyTo(program);

// Before executing a call in emulation, verify the target has a function:
Address target = op.getInput(0).getAddress();
if (program.getFunctionManager().getFunctionAt(target) != null) {
    executor.executeCall(op, frame, library);
} else {
    // skip or create function first
}

private boolean isCallTargetDefined(PcodeOp op, Program program) {
    Address target = op.getInput(0).getAddress();
    return target != null && program.getFunctionManager().getFunctionAt(target) != null;
}

try {
    executor.executeCall(op, frame, library);
} catch (PcodeExecutionException e) {
    if (e.getMessage().startsWith("Callee at") && e.getMessage().contains("not a function")) {
        // optionally create function at target, then retry
    } else { throw e; }
}

When it happens

Trigger: SymPcodeExecutor.executeCall() extracts target = op.getInput(0).getAddress(), then program.getFunctionManager().getFunctionAt(target) returns null. This occurs when the call target is to an address that hasn't been defined as a function (e.g., indirect call through a pointer, thunks, or dynamically resolved targets), or when auto-analysis hasn't been run on that region.

Common situations: The binary has an indirect call to an address Ghidra doesn't recognize as a function. Auto-analysis was skipped or incomplete. The call target is an external/thunk that wasn't resolved. The developer is emulating execution over code blocks that lack function definitions.

Related errors

• Timed out reading or writing target
• Error reading or writing target
• Issue executing callee fixup:
• Cannot get stack change for indirect call: {op}
• Unrecognized address space in {}

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/47d0882bcef174c1. Report an issue: GitHub.