NationalSecurityAgency/ghidra · error · RuntimeError

Usage: ghidra trace disassemble ADDRESS

Error message

Usage: ghidra trace disassemble ADDRESS

What it means

Raised by ghidra_trace_disassemble when the argument count is not exactly 1. The command disassembles linearly from a single seed ADDRESS into the Ghidra trace and needs precisely one address expression; zero, two, or more tokens are rejected at commands.py:1430.

Source

Thrown at Ghidra/Debug/Debugger-agent-lldb/src/main/py/src/ghidralldb/commands.py:1430

    activate(path)


@convert_errors
def ghidra_trace_disassemble(debugger: lldb.SBDebugger, command: str,
                             result: lldb.SBCommandReturnObject,
                             internal_dict: Dict[str, Any]) -> None:
    """Disassemble starting at the given seed.

    Usage: ghidra trace disassemble ADDRESS

    Disassembly proceeds linearly and terminates at the first branch or unknown
    memory encountered.
    """

    args = shlex.split(command)
    if len(args) != 1:
        raise RuntimeError("Usage: ghidra trace disassemble ADDRESS")
    address = args[0]

    trace, tx = STATE.require_tx()
    start = eval_address(address)
    if start is None:
        return
    proc = util.get_process()
    base, addr = trace.extra.require_mm().map(proc, start)
    if base != addr.space:
        trace.create_overlay_space(base, addr.space)

    length = trace.disassemble(addr)
    result.PutCString(f"Disassembled {length} bytes")


def compute_proc_state(proc: lldb.SBProcess) -> str:
    if proc.is_running:
        return 'RUNNING'

View on GitHub (pinned to d5f144c24d)

Solutions

1. Provide exactly one seed: `ghidra trace disassemble 0x100000`.
2. Use an expression/register as the single token: `ghidra trace disassemble $pc`.
3. To disassemble a range, call disassemble repeatedly or rely on putmem + Ghidra's disassembly, not a length argument.

Example fix

// before
ghidra trace disassemble 0x1000 0x2000
// after
ghidra trace disassemble 0x1000

parts = command.split()
assert len(parts) == 1, "disassemble takes exactly one ADDRESS"

When it happens

Trigger: Calling `ghidra trace disassemble` with no address (`ghidra trace disassemble`), or with extra tokens such as `ghidra trace disassemble 0x1000 0x2000` (disassemble takes a start only, not a range), or a pasted address+label string that splits into two tokens.

Common situations: Developers assume disassemble accepts ADDRESS LENGTH (like putmem) and pass two values; or they forget the address after a target switch. Some forget to prefix a register/expr and the shell splits it.

Related errors

• Usage: ghidra trace put-processes
• Usage: ghidra trace put-available
• Usage: ghidra trace put-breakpoints
• Usage: ghidra trace put-watchpoints
• Usage: ghidra trace put-environment

AI-assisted analysis of NationalSecurityAgency/ghidra@d5f144c24d (2026-08-14). Data as JSON: /api/errors/66e19b545af1b52a. Report an issue: GitHub.