{"record":{"id":"8b278250821491d9","repo":"NationalSecurityAgency/ghidra","slug":"read-bad-library-placeholder-md5-for-executablerec","errorCode":null,"errorMessage":"Read bad library placeholder md5 for ExecutableRecord","messagePattern":"Read bad library placeholder md5 for ExecutableRecord","errorType":"exception","errorClass":"LSHException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/description/ExecutableRecord.java","lineNumber":669,"sourceCode":"\t\t\t\telse if (nm.equals(\"repository\")) {\n\t\t\t\t\trepo = parser.end().getText();\n\t\t\t\t}\n\t\t\t\telse if (nm.equals(\"path\")) {\n\t\t\t\t\tpath = parser.end().getText();\n\t\t\t\t}\n\t\t\t\telse {\n\t\t\t\t\tparser.end();\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tparser.end(el);\n\t\tExecutableRecord res;\n\n\t\tif (islib) {\n\t\t\tres = man.newExecutableLibrary(name_exec, architecture, id);\n\t\t\tif ((!res.getMd5().equals(md5sum))) {\n\t\t\t\tthrow new LSHException(\"Read bad library placeholder md5 for ExecutableRecord\");\n\t\t\t}\n\t\t}\n\t\telse {\n\t\t\tfinal long date_milli = seconds * 1000 + millis;\n\t\t\tres = man.newExecutableRecord(md5sum, name_exec, name_compiler, architecture,\n\t\t\t\tnew Date(date_milli), repo, path, id);\n\t\t}\n\t\tres.setCategory(cats);\n\t\treturn res;\n\t}\n\n\t@Override\n\tpublic boolean equals(Object obj) {\n\t\tif (obj == null) {\n\t\t\treturn false;\n\t\t}\n\n\t\tif (this == obj) {","sourceCodeStart":651,"sourceCodeEnd":687,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/description/ExecutableRecord.java#L651-L687","documentation":"Thrown during ExecutableRecord.restoreXml when the XML declares a library ('islib') entry: after creating the library via man.newExecutableLibrary(name_exec, architecture, id), the loader recomputes the library md5 placeholder and compares it to the md5sum read from the XML. A mismatch means the XML's md5 is inconsistent with the (name, architecture) it claims, indicating a corrupt or tampered document.","triggerScenarios":"restoreXml parsing a library 'exe' element whose md5sum attribute does not equal calcLibraryMd5Placeholder(name_exec, architecture) for the parsed name/architecture. Caused by hand-edited or truncated BSim XML, or by a writer that did not use the placeholder scheme.","commonSituations":"Manually edited XML; data exported by a third-party/incompatible tool; name or architecture fields altered after the md5 was written; partial file corruption.","solutions":["Re-export the BSim data from a trusted source so the library md5 placeholder matches name+architecture.","Recompute and correct the md5sum attribute to equal calcLibraryMd5Placeholder(name, architecture) if you control the document.","Validate the document against the expected BSim XML schema before restoreXml."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    ExecutableRecord.restoreXml(parser, man);\n} catch (LSHException e) {\n    if (e.getMessage().contains(\"bad library placeholder md5\")) {\n        // re-export the document from a trusted source\n    } else throw e;\n}","preventionTips":["Only restoreXml documents produced by a compatible, trusted Ghidra version.","Do not hand-edit library name/architecture/md5 fields in BSim XML.","Validate schema and integrity before importing third-party BSim data."],"tags":["bsim","xml","data-integrity","corruption","java"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}