NationalSecurityAgency/ghidra · error · ConcretionError

Cannot make 'addresses read' concrete buffers

Error message

Cannot make 'addresses read' concrete buffers

What it means

AddressesReadTracePcodeExecutorStatePiece is an auxiliary/abstract state piece: its values are AddressSetView (the union of address ranges read), never concrete byte arrays. When the p-code executor needs a concrete MemBuffer (e.g. to DECODE an instruction, or INSPECT a value), it calls getConcreteBuffer, which this piece always rejects with a ConcretionError. The piece exists to be paired on the abstract/right side with a concrete bytes piece, not to satisfy byte reads itself.

Source

Thrown at Ghidra/Debug/Framework-TraceModeling/src/main/java/ghidra/pcode/exec/trace/AddressesReadTracePcodeExecutorStatePiece.java:70

	}

	/**
	 * Construct the state piece
	 * 
	 * @param data the trace data access shim
	 */
	public AddressesReadTracePcodeExecutorStatePiece(PcodeTraceDataAccess data) {
		this(data, new HashMap<>());
	}

	@Override
	protected AddressSetView checkSize(int size, AddressSetView val) {
		return val;
	}

	@Override
	public MemBuffer getConcreteBuffer(Address address, Purpose purpose) {
		throw new ConcretionError("Cannot make 'addresses read' concrete buffers", purpose);
	}

	@Override
	public AddressesReadTracePcodeExecutorStatePiece fork(PcodeStateCallbacks cb) {
		return new AddressesReadTracePcodeExecutorStatePiece(data, new HashMap<>(unique));
	}

	@Override
	protected Map<Register, AddressSetView> getRegisterValuesFromSpace(AddressSpace s,
			List<Register> registers) {
		return Map.of();
	}

	@Override
	public Map<Register, AddressSetView> getRegisterValues() {
		return Map.of();
	}

View on GitHub (pinned to d5f144c24d)

Solutions

1. Pair this piece on the RIGHT/abstract side with a BytesPcodeExecutorStatePiece (or equivalent concrete piece) on the LEFT, so concrete-buffer requests route to the bytes piece: state.paired(new AddressesReadTracePcodeExecutorStatePiece(data)).
2. Never use this piece as the sole state piece for emulation or instruction decode; use a bytes state (e.g. via TraceEmulationIntegration.bytesImmediateWrite).
3. If you only need read-range tracking for a Sleigh expression, ensure the expression evaluation does not force concretion (avoid INSPECT-style reads over memory the piece abstracts).

Example fix

// before: only the addresses-read piece
PcodeExecutorStatePiece<byte[],AddressSetView> piece =
    new AddressesReadTracePcodeExecutorStatePiece(data);
PcodeExecutor<AddressSetView> exec = new PcodeExecutor<>(language, arith, piece, Reason.INSPECT);
// decode fails: getConcreteBuffer throws ConcretionError

// after: pair with a concrete bytes piece on the left
BytesPcodeExecutorState bytes = new BytesPcodeExecutorState(language, cb);
PcodeExecutorState<Pair<byte[],AddressSetView>> paired =
    bytes.paired(new AddressesReadTracePcodeExecutorStatePiece(data));

// Never request concrete buffers from this piece. Confirm a concrete piece backs the state.
PcodeExecutorStatePiece<?, ?> left = ...; // your concrete bytes piece
if (left instanceof AddressesReadTracePcodeExecutorStatePiece) {
    throw new IllegalStateException(
        "AddressesRead piece cannot serve concrete buffers; pair it with a bytes piece on the left.");
}

// A state piece that can never produce bytes — detect and exclude from the concrete role.
static boolean canProvideBytes(PcodeExecutorStatePiece<?, ?> piece) {
    return !(piece instanceof AddressesReadTracePcodeExecutorStatePiece);
}

// ConcretionError is a PcodeExecutionException; catching it means a fundamental wiring mistake.
try {
    exec.execute();
} catch (ConcretionError e) {
    PcodeArithmetic.Purpose p = e.getPurpose(); // DECODE/INSPECT/etc.
    // Fix state wiring rather than swallowing: ensure a concrete bytes piece is on the left.
    throw new IllegalStateException("state cannot concretize for purpose " + p, e);
}

When it happens

Trigger: Instantiating a PcodeExecutor whose only state piece (or whose left/concrete piece) is an AddressesReadTracePcodeExecutorStatePiece, then running anything that concretizes: SleighInstructionDecoder.getConcreteBuffer(addr, DECODE), EmulatorUtilities reading a pointer (INSPECT), or arithmetic.toConcrete. Also any p-code op that forces concretion (BRANCH/LOAD/STORE addresses, CONDITION).

Common situations: Using the addresses-read piece standalone for expression evaluation that touches memory it cannot represent as bytes. Wiring it as the left side of a PairedPcodeExecutorStatePiece (so getConcreteBuffer delegates to it) instead of the right. Running emulation that decodes instructions against a state built only from this piece.

Related errors

• Sleigh language required
• DataType %s has dynamic length
• Input %s conflicts: 0x%s != 0x%s
• Emulation requires a Sleigh language
• Timed out reading or writing target

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/97555e8646bfed30. Report an issue: GitHub.