{"record":{"id":"cfcb238ffeb5ed28","repo":"NationalSecurityAgency/ghidra","slug":"could-not-resolve-filter-specifying-executable-cfcb23","errorCode":null,"errorMessage":"Could not resolve filter specifying executable: ","messagePattern":"Could not resolve filter specifying executable: ","errorType":"exception","errorClass":"ElasticException","httpStatus":null,"severity":"error","filePath":"Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticDatabase.java","lineNumber":2684,"sourceCode":"\t\t}\n\t}\n\n\t/**\n\t * Given the name of an executable library, its architecture, and a function name,\n\t * return the id of the document describing this specific function.\n\t * These 3 Strings are designed to uniquely identify a library function.\n\t * @param exeName is the name of the executable\n\t * @param funcName is the name of the function\n\t * @param arch is the executable architecture\n\t * @return the document id of the matching function\n\t * @throws ElasticException if the function (the executable) doesn't exist\n\t */\n\tpublic String recoverExternalFunctionId(String exeName, String funcName, String arch)\n\t\t\tthrows ElasticException {\n\t\tString md5 = ExecutableRecord.calcLibraryMd5Placeholder(exeName, arch);\n\t\tJsonObject row = queryMd5ExeMatch(md5);\n\t\tif (row == null) {\n\t\t\tthrow new ElasticException(\n\t\t\t\t\"Could not resolve filter specifying executable: \" + exeName);\n\t\t}\n\t\tString exeId = row.get(\"_id\").getAsString();\n\t\tJsonArray descres = queryFuncNameMatch(exeId, funcName, 2);\n\t\tif (1 != descres.size()) {\n\t\t\tthrow new ElasticException(\n\t\t\t\t\"Could not resolve filter specifying function: [\" + exeName + \"]\" + funcName);\n\t\t}\n\t\tRowKeyElastic eKey = RowKeyElastic.parseExeIdString(exeId);\n\t\tStringBuilder buffer = new StringBuilder();\n\t\teKey.generateLibraryFunctionId(buffer, funcName);\n\t\treturn buffer.toString();\n\t}\n\n\t/**\n\t * For every function currently in the manager, fill in its call-graph information.\n\t * This involves querying the database for child information, adding the cross-link\n\t * information (CallgraphEntry) between FunctionDescriptions, and possibly querying","sourceCodeStart":2666,"sourceCodeEnd":2702,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Features/BSim/src/main/java/ghidra/features/bsim/query/elastic/ElasticDatabase.java#L2666-L2702","documentation":"Thrown in recoverExternalFunctionId when queryMd5ExeMatch returns null for the computed library MD5 placeholder. The MD5 placeholder is derived from exeName and arch via ExecutableRecord.calcLibraryMd5Placeholder; if no executable record matches, the specified library executable does not exist in the database.","triggerScenarios":"Calling recoverExternalFunctionId(exeName, funcName, arch) where the library executable has not been ingested. queryMd5ExeMatch issues a term query on the md5 field of the executable index; no match yields null.","commonSituations":"Referencing a library function filter before ingesting the library executable; typo in the exeName or arch parameter; the library was ingested as a non-library executable (no library MD5 placeholder); architecture identifier mismatch (e.g., x86 vs x86:LE:32:default).","solutions":["Ingest the library executable before referencing its functions in external function filters.","Verify the exeName and arch parameters exactly match what was used during ingestion.","Ensure the executable was ingested as a library type so calcLibraryMd5Placeholder produces the correct MD5.","Query the executable index by name_exec and architecture to confirm the record exists."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Verify the library executable exists before calling recoverExternalFunctionId\nString md5 = ExecutableRecord.calcLibraryMd5Placeholder(exeName, arch);\nJsonObject row = queryMd5ExeMatch(md5);\nif (row == null) {\n    throw new IllegalArgumentException(\n        \"Library executable not found: \" + exeName + \" (\" + arch + \"). Ingest it first.\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    String funcId = database.recoverExternalFunctionId(exeName, funcName, arch);\n} catch (ElasticException e) {\n    if (e.getMessage().contains(\"Could not resolve filter specifying executable\")) {\n        Msg.warn(this, \"Library executable not ingested: \" + exeName + \" (\" + arch + \")\");\n        // Ingest the library first, then retry\n    }\n    throw e;\n}","preventionTips":["Ingest library executables before referencing their functions in filters.","Verify exeName and arch match exactly what was used during ingestion.","Maintain a registry of ingested library executables to validate references upfront."],"tags":["bsim","library","query","missing-data","filter","external-function"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}