NationalSecurityAgency/ghidra · error · ElasticException

Could not resolve filter specifying executable:

Error message

Could not resolve filter specifying executable: 

What it means

Thrown in recoverExternalFunctionId when queryMd5ExeMatch returns null for the computed library MD5 placeholder. The MD5 placeholder is derived from exeName and arch via ExecutableRecord.calcLibraryMd5Placeholder; if no executable record matches, the specified library executable does not exist in the database.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticDatabase.java:2684

		}
	}

	/**
	 * Given the name of an executable library, its architecture, and a function name,
	 * return the id of the document describing this specific function.
	 * These 3 Strings are designed to uniquely identify a library function.
	 * @param exeName is the name of the executable
	 * @param funcName is the name of the function
	 * @param arch is the executable architecture
	 * @return the document id of the matching function
	 * @throws ElasticException if the function (the executable) doesn't exist
	 */
	public String recoverExternalFunctionId(String exeName, String funcName, String arch)
			throws ElasticException {
		String md5 = ExecutableRecord.calcLibraryMd5Placeholder(exeName, arch);
		JsonObject row = queryMd5ExeMatch(md5);
		if (row == null) {
			throw new ElasticException(
				"Could not resolve filter specifying executable: " + exeName);
		}
		String exeId = row.get("_id").getAsString();
		JsonArray descres = queryFuncNameMatch(exeId, funcName, 2);
		if (1 != descres.size()) {
			throw new ElasticException(
				"Could not resolve filter specifying function: [" + exeName + "]" + funcName);
		}
		RowKeyElastic eKey = RowKeyElastic.parseExeIdString(exeId);
		StringBuilder buffer = new StringBuilder();
		eKey.generateLibraryFunctionId(buffer, funcName);
		return buffer.toString();
	}

	/**
	 * For every function currently in the manager, fill in its call-graph information.
	 * This involves querying the database for child information, adding the cross-link
	 * information (CallgraphEntry) between FunctionDescriptions, and possibly querying

View on GitHub (pinned to d5f144c24d)

Solutions

1. Ingest the library executable before referencing its functions in external function filters.
2. Verify the exeName and arch parameters exactly match what was used during ingestion.
3. Ensure the executable was ingested as a library type so calcLibraryMd5Placeholder produces the correct MD5.
4. Query the executable index by name_exec and architecture to confirm the record exists.

// Verify the library executable exists before calling recoverExternalFunctionId
String md5 = ExecutableRecord.calcLibraryMd5Placeholder(exeName, arch);
JsonObject row = queryMd5ExeMatch(md5);
if (row == null) {
    throw new IllegalArgumentException(
        "Library executable not found: " + exeName + " (" + arch + "). Ingest it first.");
}

try {
    String funcId = database.recoverExternalFunctionId(exeName, funcName, arch);
} catch (ElasticException e) {
    if (e.getMessage().contains("Could not resolve filter specifying executable")) {
        Msg.warn(this, "Library executable not ingested: " + exeName + " (" + arch + ")");
        // Ingest the library first, then retry
    }
    throw e;
}

When it happens

Trigger: Calling recoverExternalFunctionId(exeName, funcName, arch) where the library executable has not been ingested. queryMd5ExeMatch issues a term query on the md5 field of the executable index; no match yields null.

Common situations: Referencing a library function filter before ingesting the library executable; typo in the exeName or arch parameter; the library was ingested as a non-library executable (no library MD5 placeholder); architecture identifier mismatch (e.g., x86 vs x86:LE:32:default).

Related errors

• Could not resolve filter specifying function: [
• Could not resolve filter specifying executable:
• Could not resolve filter specifying function: [
• {getType()}scripts cannot be used for context [{context.name
• Unknown script name {scriptSource}

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/cfcb238ffeb5ed28. Report an issue: GitHub.