{"record":{"id":"47d0882bcef174c1","repo":"NationalSecurityAgency/ghidra","slug":"callee-at-target-is-not-a-function","errorCode":null,"errorMessage":"Callee at {target} is not a function.","messagePattern":"Callee at (.+?) is not a function\\.","errorType":"exception","errorClass":"PcodeExecutionException","httpStatus":null,"severity":"error","filePath":"Ghidra/Debug/Debugger/src/main/java/ghidra/app/plugin/core/debug/stack/SymPcodeExecutor.java","lineNumber":150,"sourceCode":"\t\treturn extrapop;\n\t}\n\n\t/**\n\t * Attempt to figure the stack depth change for a given function\n\t * \n\t * @param callee the function being called\n\t * @return the depth change, i.e., change to SP\n\t */\n\tpublic int computeStackChange(Function callee) {\n\t\treturn computeStackChange(callee, warnings);\n\t}\n\n\t@Override\n\tpublic void executeCall(PcodeOp op, PcodeFrame frame, PcodeUseropLibrary<Sym> library) {\n\t\tAddress target = op.getInput(0).getAddress();\n\t\tFunction callee = program.getFunctionManager().getFunctionAt(target);\n\t\tif (callee == null) {\n\t\t\tthrow new PcodeExecutionException(\"Callee at \" + target + \" is not a function.\", frame);\n\t\t}\n\t\tString fixupName = callee.getCallFixup();\n\t\tif (fixupName != null && !\"\".equals(fixupName)) {\n\t\t\tPcodeProgram snippet;\n\t\t\ttry {\n\t\t\t\tsnippet = PcodeProgram.fromInject(program, fixupName, InjectPayload.CALLFIXUP_TYPE);\n\t\t\t\texecute(snippet, library);\n\t\t\t}\n\t\t\tcatch (MemoryAccessException | UnknownInstructionException | NotFoundException\n\t\t\t\t\t| IOException e) {\n\t\t\t\tthrow new PcodeExecutionException(\"Issue executing callee fixup: \", e);\n\t\t\t}\n\t\t\treturn;\n\t\t}\n\t\tint change = computeStackChange(callee);\n\t\tadjustStack(change);\n\t}\n","sourceCodeStart":132,"sourceCodeEnd":168,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Debug/Debugger/src/main/java/ghidra/app/plugin/core/debug/stack/SymPcodeExecutor.java#L132-L168","documentation":"Thrown during symbolic p-code execution when a CALL operation's target address does not have a Function defined at it in the program's FunctionManager. The SymPcodeExecutor.executeCall() resolves the call target from the p-code op, looks up getFunctionAt(target), and throws PcodeExecutionException if null — meaning the call destination exists in memory but Ghidra has no function analysis there.","triggerScenarios":"SymPcodeExecutor.executeCall() extracts target = op.getInput(0).getAddress(), then program.getFunctionManager().getFunctionAt(target) returns null. This occurs when the call target is to an address that hasn't been defined as a function (e.g., indirect call through a pointer, thunks, or dynamically resolved targets), or when auto-analysis hasn't been run on that region.","commonSituations":"The binary has an indirect call to an address Ghidra doesn't recognize as a function. Auto-analysis was skipped or incomplete. The call target is an external/thunk that wasn't resolved. The developer is emulating execution over code blocks that lack function definitions.","solutions":["Define a function at the call target address in the Ghidra listing (right-click > Create Function).","Run full auto-analysis on the program to populate the FunctionManager.","If the target is an external function, ensure the external location is properly resolved.","Check that the p-code op's input(0) address is correct and not corrupted by a bad disassembly."],"exampleFix":"// Before: call target has no function — emulation throws.\n// After: in Ghidra listing, navigate to target address and create function.\n// Or programmatically:\n// CreateFunctionCmd cmd = new CreateFunctionCmd(targetAddress);\n// cmd.applyTo(program);","handlingStrategy":"validation","validationCode":"// Before executing a call in emulation, verify the target has a function:\nAddress target = op.getInput(0).getAddress();\nif (program.getFunctionManager().getFunctionAt(target) != null) {\n    executor.executeCall(op, frame, library);\n} else {\n    // skip or create function first\n}","typeGuard":"private boolean isCallTargetDefined(PcodeOp op, Program program) {\n    Address target = op.getInput(0).getAddress();\n    return target != null && program.getFunctionManager().getFunctionAt(target) != null;\n}","tryCatchPattern":"try {\n    executor.executeCall(op, frame, library);\n} catch (PcodeExecutionException e) {\n    if (e.getMessage().startsWith(\"Callee at\") && e.getMessage().contains(\"not a function\")) {\n        // optionally create function at target, then retry\n    } else { throw e; }\n}","preventionTips":["Run auto-analysis with the 'Function Start Search' analyzer before emulation.","Define functions at known call targets before executing symbolic p-code.","For indirect calls, resolve targets through references before emulation."],"tags":["pcode","emulation","function-manager","call-resolution"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}