NationalSecurityAgency/ghidra · error · RuntimeError

Usage: ghidra trace delmem ADDRESS LENGTH

Error message

Usage: ghidra trace delmem ADDRESS LENGTH

What it means

Usage error raised by ghidra_trace_delmem when the token count is not exactly 2. delmem intentionally has no PAGES argument (the docstring warns deletion should be deliberate), so only ADDRESS and LENGTH are accepted.

Source

Thrown at Ghidra/Debug/Debugger-agent-lldb/src/main/py/src/ghidralldb/commands.py:850

@convert_errors
def ghidra_trace_delmem(debugger: lldb.SBDebugger, command: str,
                        result: lldb.SBCommandReturnObject,
                        internal_dict: Dict[str, Any]) -> None:
    """Delete the given range of memory from the Ghidra trace.

    Usage: ghidra trace delmem ADDRESS LENGTH

    Why would you do this? There are probably good reasons, but please consider
    that deleting information is typically not helping the user.

    Note there is no PAGES argument. This is to prevent accidental deletion of
    more bytes than intended. Expand the range manually, if you must.
    """

    trace = STATE.require_trace()
    args = shlex.split(command)
    if len(args) != 2:
        raise RuntimeError("Usage: ghidra trace delmem ADDRESS LENGTH")
    address = args[0]
    length = args[1]

    STATE.require_tx()
    start, end = eval_range(address, length)
    if start is None or end is None:
        return
    proc = util.get_process()
    base, addr = trace.extra.require_mm().map(proc, start)
    # Do not create the space. We're deleting stuff.
    trace.delete_bytes(addr.extend(end - start))


# Yes, lldb puts each full bank in a "value", with chilren for each reg
def putreg(frame: lldb.SBFrame, bank: lldb.SBValue) -> None:
    proc = util.get_process()
    space = REGS_PATTERN.format(procnum=proc.GetProcessID(),
                                tnum=util.selected_thread().GetThreadID(),

View on GitHub (pinned to d5f144c24d)

Solutions

1. Pass exactly two tokens: ADDRESS LENGTH.
2. To delete a wider range, expand ADDRESS/LENGTH manually rather than passing PAGES.
3. Double-check that deletion is intended; the docstring warns this is rarely helpful.

Example fix

// before
ghidra trace delmem 0x10000 0x100 1
// after
ghidra trace delmem 0x10000 0x100

import shlex

def validate_delmem(command: str) -> None:
    if len(shlex.split(command)) != 2:
        raise ValueError('delmem needs exactly ADDRESS LENGTH (no PAGES)')

try:
    ghidra_trace_delmem(debugger, command, result, internal_dict)
except RuntimeError as e:
    if str(e).startswith('Usage:'):
        result.SetError(str(e))
    else:
        raise

When it happens

Trigger: Passing 0, 1, 3+ tokens; attempting to add a PAGES flag (rejected by design); including STATE or other trailing arguments.

Common situations: User assumes delmem mirrors putmem's signature and tries to add PAGES; user pastes a 3-token putmem-style command into delmem.

Related errors

• Usage: ghidra trace putmem ADDRESS LENGTH [PAGES]
• Usage: ghidra trace putval EXPRESSION [PAGES]
• Usage: ghidra trace putmem ADDRESS LENGTH STATE [PAGES]
• Usage: ghidra trace putreg [GROUP]
• Usage: ghidra trace delreg [GROUP]

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/a24230302cd9d744. Report an issue: GitHub.