NationalSecurityAgency/ghidra · error · LSHException

Could not resolve filter specifying executable:

Error message

Could not resolve filter specifying executable: 

What it means

`recoverExternalFunctionId` computes a placeholder MD5 for an external (library) executable from its name + arch, then queries `exeTable` for a match. If no `ExecutableRow` is returned, it throws LSHException -- the referenced external executable is not present in the database, so the filter naming it cannot be resolved.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/AbstractSQLFunctionDatabase.java:936

	}

	/**
	 * Low level count decrement of a vector record from vectable, if count
	 * reaches zero, the record is deleted
	 * @param id vector row ID
	 * @param countdiff the amount to subtract from count
	 * @return 0 if decrement short of 0, return 1 if record was removed, return
	 *         -1 if there was a problem
	 * @throws SQLException if there is a problem creating or executing the query
	 */
	protected abstract int deleteVectors(long id, int countdiff) throws SQLException;

	long recoverExternalFunctionId(String exename, String functionname, String reparch)
			throws SQLException, LSHException {
		String md5 = ExecutableRecord.calcLibraryMd5Placeholder(exename, reparch);
		ExecutableRow row = exeTable.queryMd5ExeMatch(md5);
		if (row == null) {
			throw new LSHException("Could not resolve filter specifying executable: " + exename);
		}

		DescriptionRow descRow = descTable.queryFuncNameAddr(row.rowid, functionname, -1);
		if (descRow == null) {
			throw new LSHException(
				"Could not resolve filter specifying function: [" + exename + "]" + functionname);
		}
		return descRow.rowid;
	}

	// Pulled-in from old FunctionDatabaseClient

	/**
	 * Make sure the FunctionDescription has its attached SignatureRecord, if not, query for it
	 * @param functionDescription is the FunctionDescription
	 * @param descriptionManager is the container
	 * @param sigmap is a container of cached SignatureRecords which is checked before querying (may be null)
	 * @throws SQLException if there is a problem querying the vector ID

View on GitHub (pinned to d5f144c24d)

Solutions

1. Ingest the named external executable first so its ExecutableRow exists.
2. Verify the exe name and architecture string exactly match how it was stored.
3. Re-check the filter specification passed to the query.

// Before issuing a filtered query, confirm the external executable exists.
String md5 = ExecutableRecord.calcLibraryMd5Placeholder(exename, reparch);
ExecutableRow row = exeTable.queryMd5ExeMatch(md5);
if (row == null) {
    throw new IllegalArgumentException(
        "External executable not ingested: " + exename + " / " + reparch);
}

try {
    long id = db.recoverExternalFunctionId(exename, functionname, reparch);
} catch (LSHException e) {
    if (e.getMessage().startsWith("Could not resolve filter specifying executable:")) {
        // suggest ingesting the missing library before retrying
        throw new MissingDependencyException("Ingest library first: " + exename, e);
    }
    throw e;
}

When it happens

Trigger: Issuing a query/insert whose filter references an external executable (e.g. a library like libc.so) that has not been ingested. The placeholder MD5 is derived from name + arch, so a missing library, an arch mismatch (x86 vs ARM), or a typo produces a miss.

Common situations: Querying functions from a library before ingesting the library; arch string mismatch between analysis and DB; renamed or version-different library; case-sensitive name differences.

Related errors

• Could not resolve filter specifying function: [
• Could not (uniquely) match executable
• Error querying vectorid:
• No functions matching vectorid:
• Error querying vectorid: {vecResult.vectorid}

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/784313d7a73f7823. Report an issue: GitHub.