{"record":{"id":"4e4ea8155ab94e1b","repo":"NationalSecurityAgency/ghidra","slug":"could-not-resolve-filter-specifying-function","errorCode":null,"errorMessage":"Could not resolve filter specifying function: [","messagePattern":"Could not resolve filter specifying function: \\[","errorType":"exception","errorClass":"LSHException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/AbstractSQLFunctionDatabase.java","lineNumber":941,"sourceCode":"\t * @param id vector row ID\n\t * @param countdiff the amount to subtract from count\n\t * @return 0 if decrement short of 0, return 1 if record was removed, return\n\t *         -1 if there was a problem\n\t * @throws SQLException if there is a problem creating or executing the query\n\t */\n\tprotected abstract int deleteVectors(long id, int countdiff) throws SQLException;\n\n\tlong recoverExternalFunctionId(String exename, String functionname, String reparch)\n\t\t\tthrows SQLException, LSHException {\n\t\tString md5 = ExecutableRecord.calcLibraryMd5Placeholder(exename, reparch);\n\t\tExecutableRow row = exeTable.queryMd5ExeMatch(md5);\n\t\tif (row == null) {\n\t\t\tthrow new LSHException(\"Could not resolve filter specifying executable: \" + exename);\n\t\t}\n\n\t\tDescriptionRow descRow = descTable.queryFuncNameAddr(row.rowid, functionname, -1);\n\t\tif (descRow == null) {\n\t\t\tthrow new LSHException(\n\t\t\t\t\"Could not resolve filter specifying function: [\" + exename + \"]\" + functionname);\n\t\t}\n\t\treturn descRow.rowid;\n\t}\n\n\t// Pulled-in from old FunctionDatabaseClient\n\n\t/**\n\t * Make sure the FunctionDescription has its attached SignatureRecord, if not, query for it\n\t * @param functionDescription is the FunctionDescription\n\t * @param descriptionManager is the container\n\t * @param sigmap is a container of cached SignatureRecords which is checked before querying (may be null)\n\t * @throws SQLException if there is a problem querying the vector ID\n\t */\n\tprivate void queryAssociatedSignature(FunctionDescription functionDescription,\n\t\t\tDescriptionManager descriptionManager, Map<Long, SignatureRecord> sigmap)\n\t\t\tthrows SQLException {\n\t\tif (functionDescription.getSignatureRecord() != null) {","sourceCodeStart":923,"sourceCodeEnd":959,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/client/AbstractSQLFunctionDatabase.java#L923-L959","documentation":"After `recoverExternalFunctionId` resolves the executable (the 744 check passed), it queries `descTable` for the specific function name within that executable. If no `DescriptionRow` is returned, it throws LSHException with the exe and function name. The library exists, but the named function does not.","triggerScenarios":"A filter references a function name that is absent from the (present) library -- spelling mismatch, stripped/renamed symbol, wrong address, or function simply not ingested.","commonSituations":"Static symbols differ between the analyzed and ingested library versions; obfuscation renamed the function; version skew of the library; address-based lookup expected but name given.","solutions":["Confirm the exact function-name spelling against the ingested library.","Ingest a library version whose symbol set matches the analysis.","If the function is address-keyed, switch to an address-based filter."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// After resolving the exe, confirm the function name exists before relying on it.\nDescriptionRow dr = descTable.queryFuncNameAddr(row.rowid, functionname, -1);\nif (dr == null) {\n    throw new IllegalArgumentException(\n        \"Function not in ingested library: \" + exename + \"!\" + functionname);\n}","typeGuard":null,"tryCatchPattern":"try {\n    long id = db.recoverExternalFunctionId(exename, functionname, reparch);\n} catch (LSHException e) {\n    if (e.getMessage().startsWith(\"Could not resolve filter specifying function:\")) {\n        // library present but symbol absent -- re-ingest matching library version\n        throw new MissingDependencyException(\"Symbol absent in library: \" + functionname, e);\n    }\n    throw e;\n}","preventionTips":["Align the analyzed and ingested library versions.","Prefer stable, address-based identifiers when names may drift.","Pre-check symbol presence before issuing filtered queries."],"tags":["database","query","filter","function","bsim"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}