NationalSecurityAgency/ghidra · error · LSHException

Could not find function: ${funcName}

Error message

Could not find function: ${funcName}

What it means

Thrown by ElasticDatabase.fdbQueryChildren when, after uniquely resolving the executable, queryByNameAddress returns null for one of the query.functionKeys (funcName + address). The executable matched but the named function at that address does not exist in the BSim index for that executable.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticDatabase.java:3556

		}
		ResponseChildren response = query.childrenresponse;
		ExecutableRecord exe = null;

		ExeSpecifier exeSpec = new ExeSpecifier();
		exeSpec.exemd5 = query.md5sum;
		exeSpec.exename = query.name_exec;
		exeSpec.arch = query.arch;
		exeSpec.execompname = query.name_compiler;

		exe = findSingleExecutable(exeSpec, response.manage);
		if (exe == null) {
			throw new LSHException("Could not (uniquely) match executable");
		}
		for (FunctionEntry entry : query.functionKeys) {
			FunctionDescription func =
				queryByNameAddress(response.manage, exe, entry.funcName, entry.address, true);
			if (func == null) {
				throw new LSHException("Could not find function: " + entry.funcName);
			}
			response.correspond.add(func);
		}

		TreeMap<RowKey, FunctionDescription> funcmap = new TreeMap<>();
		response.manage.generateFunctionIdMap(funcmap);
		for (FunctionDescription element : response.correspond) {
			fillinChildren(element, response.manage, funcmap);
		}
	}

	/**
	 * Entry point for the Elasticsearch version of QueryInfo command:
	 *   Query for basic information about a database
	 * @param query is command parameters
	 */
	private void fdbDatabaseInfo(QueryInfo query) {
		final ResponseInfo response = query.inforesponse;

View on GitHub (pinned to d5f144c24d)

Solutions

1. Re-ingest the executable so its function set and addresses match the current program.
2. Verify the entry.address matches the address space used at ingest (check for rebase) and the entry.funcName spelling exactly.
3. List functions for the executable first (QueryName) to confirm the function exists before issuing QueryChildren.

Example fix

// before
entry.funcName = sym.getName(true);
entry.address = addr;   // possibly rebased
// after
entry.funcName = sym.getName(true);
entry.address = program.getImageBase().add(addr.subtract(rebasedAddr));

// confirm the function exists in the indexed set before QueryChildren
ExecutableRecord exe = findSingleExecutable(spec, manager);
if (!exe.containsFunction(entry.funcName, entry.address)) {
    // re-ingest or correct the address
}

try {
    fdbQueryChildren(query);
} catch (LSHException e) {
    if (e.getMessage().startsWith("Could not find function:")) {
        // re-ingest executable or correct address/name
    } else throw e;
}

When it happens

Trigger: QueryChildren whose functionKeys reference a function name/address that was never ingested, was renamed, or whose address shifted (rebase) relative to what was indexed.

Common situations: Program was modified (functions renamed/added) after the executable was ingested into BSim; address passed is post-relocation but the DB stored the original; querying a function that BSim's ingest skipped (e.g. thunk/external).

Related errors

• No function documents matching id=${rowId}
• Elasticsearch database does not have callgraph information e
• {getType()}scripts cannot be used for context [{context.name
• Unknown script name {scriptSource}
• Document is missing "features"

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/5555e1e8342ce240. Report an issue: GitHub.