NationalSecurityAgency/ghidra · error · SleighException

Unknown register or label: '{nm}'

Error message

Unknown register or label: '{nm}'

What it means

Thrown during Sleigh expression parsing when the symbol resolver encounters a name that is neither a known register nor a defined label in the current scope. DebuggerPcodeUtils' custom SleighSymbolResolver reports the error via sc.reportError() and then throws SleighException. This occurs when evaluating p-code expressions (e.g., for register access or breakpoints) that reference undefined symbols.

Source

Thrown at Ghidra/Debug/Debugger/src/main/java/ghidra/pcode/exec/DebuggerPcodeUtils.java:193

				}
			}

			if (mode.preferId) {
				SleighSymbol symbol = tryIntegerLiteral(loc, nm, false);
				if (symbol != null) {
					return symbol;
				}
			}

			/**
			 * NOTE: This may break things that check for the absence of a symbol
			 * 
			 * I don't think it'll affect expressions, but it could later affect user Sleigh
			 * libraries that an expression might like to use. The better approach might be to pass
			 * a parameter indicating whether absence is good or bad.
			 */
			sc.reportError(loc, "Unknown register or label '%s'".formatted(nm));
			throw new SleighException("Unknown register or label: '" + nm + "'");
		}

		protected SleighSymbol tryMap(String nm, Trace trace, long snap, Program program,
				Symbol symbol, Address addr, List<SleighSymbol> externals) {
			TraceLocation tloc =
				mappings.getOpenMappedLocation(trace, new ProgramLocation(program, addr), snap);
			if (tloc == null) {
				return null;
			}
			SleighSymbol mapped = createSleighConstant(program.getName(), nm, tloc.getAddress());
			if (!symbol.isExternal()) {
				return mapped;
			}
			// Most externals will not map, but if one does, use it as a fallback
			externals.add(mapped);
			return null;
		}

View on GitHub (pinned to d5f144c24d)

Solutions

1. Verify the register or label name is valid for the current processor model.
2. Check for typos in the expression — register names are case-sensitive and architecture-specific.
3. Ensure the symbol is defined in the program's symbol table or the processor's register list.
4. If referencing a mapped symbol, verify the trace-to-program mapping covers it.
5. Consult the processor's .sleigh file for the correct register and label names.

Example fix

// Before: expression references unknown symbol
// eval "R15 + unknown_label"
//
// After: use valid register/label names for the target architecture
// eval "R15 + R0"

// No generic pre-check; symbol resolution is context-dependent.
// Validate expression tokens against known registers/labels before parsing if possible.
// Check program.getLanguage().getRegisters() for valid register names.

// Check if a name is a known register before evaluating:
boolean isKnownRegister(String name, Program program) {
    return program.getLanguage().getRegister(name) != null;
}

try {
    // evaluate Sleigh expression
} catch (SleighException e) {
    if (e.getMessage().startsWith("Unknown register or label")) {
        // inform user of valid register/label names for the architecture
    } else { throw e; }
}

When it happens

Trigger: The symbol resolver's resolve() method is called for a name 'nm' that isn't found among registers, labels, or mapped symbols. sc.reportError() is called first, then SleighException is thrown. Happens when a p-code expression references a register name that doesn't exist in the processor's register context, or a label that hasn't been defined.

Common situations: The user types a register name in a debugger expression that doesn't exist for the current processor (e.g., 'rax' on an ARM target). A Sleigh expression references an external symbol that has no mapping. The processor specification changed, renaming or removing a register. A typo in the expression.

Related errors

• Current trace does not use Sleigh
• Encountered an unimplemented instruction at {}
• Unknown context register
• Sleigh language required
• Emulation requires a Sleigh language

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/cc86c2b4e517d49c. Report an issue: GitHub.