NationalSecurityAgency/ghidra · error · LSHException

Could not resolve filter specifying function: [

Error message

Could not resolve filter specifying function: [

What it means

After `recoverExternalFunctionId` resolves the executable (the 744 check passed), it queries `descTable` for the specific function name within that executable. If no `DescriptionRow` is returned, it throws LSHException with the exe and function name. The library exists, but the named function does not.

Source

Thrown at Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/AbstractSQLFunctionDatabase.java:941

	 * @param id vector row ID
	 * @param countdiff the amount to subtract from count
	 * @return 0 if decrement short of 0, return 1 if record was removed, return
	 *         -1 if there was a problem
	 * @throws SQLException if there is a problem creating or executing the query
	 */
	protected abstract int deleteVectors(long id, int countdiff) throws SQLException;

	long recoverExternalFunctionId(String exename, String functionname, String reparch)
			throws SQLException, LSHException {
		String md5 = ExecutableRecord.calcLibraryMd5Placeholder(exename, reparch);
		ExecutableRow row = exeTable.queryMd5ExeMatch(md5);
		if (row == null) {
			throw new LSHException("Could not resolve filter specifying executable: " + exename);
		}

		DescriptionRow descRow = descTable.queryFuncNameAddr(row.rowid, functionname, -1);
		if (descRow == null) {
			throw new LSHException(
				"Could not resolve filter specifying function: [" + exename + "]" + functionname);
		}
		return descRow.rowid;
	}

	// Pulled-in from old FunctionDatabaseClient

	/**
	 * Make sure the FunctionDescription has its attached SignatureRecord, if not, query for it
	 * @param functionDescription is the FunctionDescription
	 * @param descriptionManager is the container
	 * @param sigmap is a container of cached SignatureRecords which is checked before querying (may be null)
	 * @throws SQLException if there is a problem querying the vector ID
	 */
	private void queryAssociatedSignature(FunctionDescription functionDescription,
			DescriptionManager descriptionManager, Map<Long, SignatureRecord> sigmap)
			throws SQLException {
		if (functionDescription.getSignatureRecord() != null) {

View on GitHub (pinned to d5f144c24d)

Solutions

1. Confirm the exact function-name spelling against the ingested library.
2. Ingest a library version whose symbol set matches the analysis.
3. If the function is address-keyed, switch to an address-based filter.

// After resolving the exe, confirm the function name exists before relying on it.
DescriptionRow dr = descTable.queryFuncNameAddr(row.rowid, functionname, -1);
if (dr == null) {
    throw new IllegalArgumentException(
        "Function not in ingested library: " + exename + "!" + functionname);
}

try {
    long id = db.recoverExternalFunctionId(exename, functionname, reparch);
} catch (LSHException e) {
    if (e.getMessage().startsWith("Could not resolve filter specifying function:")) {
        // library present but symbol absent -- re-ingest matching library version
        throw new MissingDependencyException("Symbol absent in library: " + functionname, e);
    }
    throw e;
}

When it happens

Trigger: A filter references a function name that is absent from the (present) library -- spelling mismatch, stripped/renamed symbol, wrong address, or function simply not ingested.

Common situations: Static symbols differ between the analyzed and ingested library versions; obfuscation renamed the function; version skew of the library; address-based lookup expected but name given.

Related errors

• Could not resolve filter specifying executable:
• Could not find function: {entry.funcName}
• Already inserted
• Error querying vectorid:
• No functions matching vectorid:

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/4e4ea8155ab94e1b. Report an issue: GitHub.