NationalSecurityAgency/ghidra · error · LSHException

Could not find function

Error message

Could not find function: {entry.funcName}

What it means

In `fdbQueryChildren`, after resolving the executable, `queryByNameAddress` looks up each requested function key. A null return -- the function name/address is absent in that executable -- causes LSHException carrying entry.funcName. The executable exists, but the requested function does not.

Solutions

1. Verify the function name and address against the executable's ingested functions.
2. Use the correct address/base consistent with ingestion.
3. Re-ingest if the function was missing from the original load.

// Confirm the function key exists in the resolved exe before querying children.
for (FunctionEntry entry : query.functionKeys) {
    FunctionDescription fd = queryByNameAddress(
        response.manage, exe, entry.funcName, entry.address, true);
    if (fd == null) {
        throw new IllegalArgumentException(
            "Function not in executable: " + exe.getNameExec() + "!" + entry.funcName);
    }
}

try {
    db.fdbQueryChildren(query);
} catch (LSHException e) {
    if (e.getMessage().startsWith("Could not find function:")) {
        // function absent in the exe -- verify name/address or re-ingest
        throw new MissingFunctionException(e.getMessage(), e);
    }
    throw e;
}

When it happens

Trigger: Requesting call-graph children for a function name (and address) that is not present in the resolved executable: wrong name, wrong address/base, or the function was never ingested.

Common situations: Symbol-name drift between analysis and ingested binary; address mismatch from different load base; function stripped in the analyzed binary; rebase differences.

Related errors

• Could not resolve filter specifying function: [
• Already inserted
• Could not resolve filter specifying executable:
• Could not (uniquely) match executable
• Error querying vectorid:

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/548182ed0bf58aff. Report an issue: GitHub.

Appendix: source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/AbstractSQLFunctionDatabase.java:2088

		}
		ResponseChildren response = query.childrenresponse;
		ExecutableRecord exe = null;

		if (query.md5sum.length() != 0) {
			exe = queryExecutableByMd5(query.md5sum, response.manage);
		}
		else {
			exe = exeTable.querySingleExecutable(response.manage, query.name_exec, query.arch,
				query.name_compiler);
			if (exe == null) {
				throw new LSHException("Could not (uniquely) match executable");
			}
		}
		for (FunctionEntry entry : query.functionKeys) {
			FunctionDescription func =
				queryByNameAddress(response.manage, exe, entry.funcName, entry.address, true);
			if (func == null) {
				throw new LSHException("Could not find function: " + entry.funcName);
			}
			response.correspond.add(func);
		}

		TreeMap<RowKey, FunctionDescription> funcmap = new TreeMap<>();
		response.manage.generateFunctionIdMap(funcmap);
		for (FunctionDescription element : response.correspond) {
			fillinChildren(element, response.manage, funcmap);
		}
	}

	private void fdbDatabaseDrop(DropDatabase query) throws LSHException {
		ResponseDropDatabase response = query.getResponse();
		if (query.databaseName == null) {
			throw new LSHException("Missing databaseName for drop database");
		}
		if (!query.databaseName.equals(ds.getServerInfo().getDBName())) {
			throw new UnsupportedOperationException("drop database name must match");

View on GitHub (pinned to d5f144c24d)