{"record":{"id":"148ddc6c7cfc1cfa","repo":"NationalSecurityAgency/ghidra","slug":"timed-out-reading-or-writing-target","errorCode":null,"errorMessage":"Timed out reading or writing target","messagePattern":"Timed out reading or writing target","errorType":"exception","errorClass":"AccessPcodeExecutionException","httpStatus":null,"severity":"error","filePath":"Ghidra/Debug/Debugger/src/main/java/ghidra/app/plugin/core/debug/service/emulation/DebuggerEmulationIntegration.java","lineNumber":132,"sourceCode":"\t * directly with a {@link PcodeExecutorState} vice a {@link PcodeEmulator}.\n\t * \n\t * @see TraceEmulationIntegration#bytesImmediateWrite(PcodeTraceAccess, TraceThread, int)\n\t * @param access the access shim for loads and stores\n\t * @param thread the trace thread for register accesses\n\t * @param frame the frame for register accesses, usually 0\n\t * @return the callbacks\n\t */\n\tpublic static PcodeStateCallbacks bytesImmediateWriteTarget(PcodeDebuggerAccess access,\n\t\t\tTraceThread thread, int frame) {\n\t\treturn bytesWriteMode(access, thread, frame, Mode.RW).wrapFor(null);\n\t}\n\n\tprotected static <T> T waitTimeout(CompletableFuture<T> future) {\n\t\ttry {\n\t\t\treturn future.get(1, TimeUnit.SECONDS);\n\t\t}\n\t\tcatch (TimeoutException e) {\n\t\t\tthrow new AccessPcodeExecutionException(\"Timed out reading or writing target\", e);\n\t\t}\n\t\tcatch (InterruptedException | ExecutionException e) {\n\t\t\tthrow new AccessPcodeExecutionException(\"Error reading or writing target\", e);\n\t\t}\n\t}\n\n\t/**\n\t * An extension/replacement of the {@link BytesPieceHandler} that may redirect reads and writes\n\t * to/from the target.\n\t * \n\t * @implNote Because piece handlers are keyed by (address-domain, value-domain), adding this to\n\t *           a writer will replace the default handler.\n\t */\n\tpublic static class TargetBytesPieceHandler extends BytesPieceHandler {\n\t\tprotected final Mode mode;\n\n\t\tpublic TargetBytesPieceHandler(Mode mode) {\n\t\t\tthis.mode = mode;","sourceCodeStart":114,"sourceCodeEnd":150,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Debug/Debugger/src/main/java/ghidra/app/plugin/core/debug/service/emulation/DebuggerEmulationIntegration.java#L114-L150","documentation":"DebuggerEmulationIntegration.waitTimeout() wraps an asynchronous target memory read/write in future.get(1, TimeUnit.SECONDS). If the target does not respond within that hard-coded one second, the TimeoutException is rethrown as AccessPcodeExecutionException(\"Timed out reading or writing target\"). This fires during p-code emulation when a memory piece is configured to redirect reads/writes to the live target (e.g. bytesImmediateWriteTarget / bytesWriteMode with Mode.RW).","triggerScenarios":"Emulating a trace whose bytes piece handler is in RW mode (redirecting to target) while the target is slow, paused, or unresponsive. Calling p-code execution that touches a memory address not present in the emulator cache, forcing a synchronous target fetch through waitTimeout. A halted/disconnected target during emulation.","commonSituations":"Slow remote debug targets (GDB over network, traced targets under heavy load). Emulating large memory regions that trigger many target round-trips. Target stepping/breaking while an emulation step is in flight. Latency spikes on the debug connector exceeding the fixed 1s budget.","solutions":["Keep the target responsive and not stopped on a synchronous operation while emulating (resume/continue the target so it services memory requests).","Reduce target-touching during emulation by caching/warming the emulator memory so p-code execution does not need to round-trip to the target.","Use an emulation mode that does not redirect to the target (read from trace/emulator state) instead of RW-to-target.","Investigate the underlying target/debug-connector latency and increase throughput or move the target closer."],"exampleFix":"// before: emulation redirects every byte access to a slow target\nPcodeStateCallbacks cb = DebuggerEmulationIntegration.bytesImmediateWriteTarget(access, thread, frame);\n\n// after: warm the emulator from the trace and avoid target round-trips,\n// or ensure the target is running/responsive before emulating\naccess.getPcodeExecutor().getMemory().setState(...); // pre-load bytes\n","handlingStrategy":"try-catch","validationCode":"// No pre-call validation; the timeout is internal. Mitigate by ensuring target responsiveness\n// before emulating: confirm the target is running and not blocked.\nif (!targetService.isTargetAlive(target)) {\n    throw new IllegalStateException(\"Target unavailable; cannot emulate with target access\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    executor.execute(injection);\n} catch (AccessPcodeExecutionException e) {\n    if (e.getMessage().contains(\"Timed out\")) {\n        // target too slow: warm emulator cache or avoid target-touching p-code\n    } else throw e;\n}","preventionTips":["Warm the emulator memory from the trace so p-code execution does not round-trip to the target.","Avoid RW-to-target bytes pieces for slow/networked targets; prefer read-from-trace.","Keep the target responsive (not stopped on a synchronous op) while emulating."],"tags":["emulation","timeout","target-access","pcode","concurrency"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}