NationalSecurityAgency/ghidra · error · LSHException

Could not find function: {entry.funcName}

Error message

Could not find function: {entry.funcName}

What it means

In `fdbQueryChildren`, after resolving the executable, `queryByNameAddress` looks up each requested function key. A null return -- the function name/address is absent in that executable -- causes LSHException carrying entry.funcName. The executable exists, but the requested function does not.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/AbstractSQLFunctionDatabase.java:2088

		}
		ResponseChildren response = query.childrenresponse;
		ExecutableRecord exe = null;

		if (query.md5sum.length() != 0) {
			exe = queryExecutableByMd5(query.md5sum, response.manage);
		}
		else {
			exe = exeTable.querySingleExecutable(response.manage, query.name_exec, query.arch,
				query.name_compiler);
			if (exe == null) {
				throw new LSHException("Could not (uniquely) match executable");
			}
		}
		for (FunctionEntry entry : query.functionKeys) {
			FunctionDescription func =
				queryByNameAddress(response.manage, exe, entry.funcName, entry.address, true);
			if (func == null) {
				throw new LSHException("Could not find function: " + entry.funcName);
			}
			response.correspond.add(func);
		}

		TreeMap<RowKey, FunctionDescription> funcmap = new TreeMap<>();
		response.manage.generateFunctionIdMap(funcmap);
		for (FunctionDescription element : response.correspond) {
			fillinChildren(element, response.manage, funcmap);
		}
	}

	private void fdbDatabaseDrop(DropDatabase query) throws LSHException {
		ResponseDropDatabase response = query.getResponse();
		if (query.databaseName == null) {
			throw new LSHException("Missing databaseName for drop database");
		}
		if (!query.databaseName.equals(ds.getServerInfo().getDBName())) {
			throw new UnsupportedOperationException("drop database name must match");

View on GitHub (pinned to d5f144c24d)

Solutions

1. Verify the function name and address against the executable's ingested functions.
2. Use the correct address/base consistent with ingestion.
3. Re-ingest if the function was missing from the original load.

// Confirm the function key exists in the resolved exe before querying children.
for (FunctionEntry entry : query.functionKeys) {
    FunctionDescription fd = queryByNameAddress(
        response.manage, exe, entry.funcName, entry.address, true);
    if (fd == null) {
        throw new IllegalArgumentException(
            "Function not in executable: " + exe.getNameExec() + "!" + entry.funcName);
    }
}

try {
    db.fdbQueryChildren(query);
} catch (LSHException e) {
    if (e.getMessage().startsWith("Could not find function:")) {
        // function absent in the exe -- verify name/address or re-ingest
        throw new MissingFunctionException(e.getMessage(), e);
    }
    throw e;
}

When it happens

Trigger: Requesting call-graph children for a function name (and address) that is not present in the resolved executable: wrong name, wrong address/base, or the function was never ingested.

Common situations: Symbol-name drift between analysis and ingested binary; address mismatch from different load base; function stripped in the analyzed binary; rebase differences.

Related errors

• Could not resolve filter specifying function: [
• Could not resolve filter specifying executable:
• Already inserted
• Error querying vectorid:
• No functions matching vectorid:

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/548182ed0bf58aff. Report an issue: GitHub.