{"record":{"id":"d93e927ff61971d8","repo":"NationalSecurityAgency/ghidra","slug":"usage-ghidra-trace-get-values-pattern","errorCode":null,"errorMessage":"Usage: ghidra trace get-values PATTERN","messagePattern":"Usage: ghidra trace get-values PATTERN","errorType":"exception","errorClass":"RuntimeError","httpStatus":null,"severity":"error","filePath":"Ghidra/Debug/Debugger-agent-lldb/src/main/py/src/ghidralldb/commands.py","lineNumber":1338,"sourceCode":"                            result: lldb.SBCommandReturnObject,\n                            internal_dict: Dict[str, Any]) -> None:\n    \"\"\"List all values matching a given path pattern.\n\n    Usage: ghidra trace get-values PATTERN\n\n    PATTERN is a path where blanks indicate wild cards. Beware, this may seem a\n    little odd, esp., when the final key is a wild card. Here are some examples:\n\n       Processes[]             To get all processes\n       Processes[0].Threads[]  To get all threads in the first process\n       Processes[].Threads[]   To get all threads from all processes\n       Processes[0].           (Note the trailing period) to get all attributes\n                               of the first process\n    \"\"\"\n\n    args = shlex.split(command)\n    if len(args) != 1:\n        raise RuntimeError(\"Usage: ghidra trace get-values PATTERN\")\n    pattern = args[0]\n\n    trace = STATE.require_trace()\n    values = wait(trace.get_values(pattern))\n    print_tabular_values(values, result.PutCString)\n\n\n@convert_errors\ndef ghidra_trace_get_values_rng(debugger: lldb.SBDebugger, command: str,\n                                result: lldb.SBCommandReturnObject,\n                                internal_dict: Dict[str, Any]) -> None:\n    \"\"\"List all values intersecting a given address range.\n\n    Usage: ghidra trace get-values-rng ADDRESS LENGTH\n\n    This can only retrieve values of type ADDRESS or RANGE.\n    NOTE: Even in batch mode, this request will block for the result.\n    \"\"\"","sourceCodeStart":1320,"sourceCodeEnd":1356,"githubUrl":"https://github.com/NationalSecurityAgency/ghidra/blob/d5f144c24d6bc53c9cbf4448c6d11143e7696206/Ghidra/Debug/Debugger-agent-lldb/src/main/py/src/ghidralldb/commands.py#L1320-L1356","documentation":"Usage error raised by ghidra_trace_get_values when the token count is not exactly 1. get_values takes a single PATTERN where blanks act as wildcards (e.g. Processes[].Threads[]) and prints matching values tabularly.","triggerScenarios":"Zero tokens; passing multiple patterns; quoting that splits the pattern; passing flags the command does not accept.","commonSituations":"User passes a plain PATH instead of a pattern with wildcards; user adds trailing arguments; user forgets the pattern entirely.","solutions":["Pass exactly one PATTERN token, using [] or trailing period for wildcards.","Quote the command so the pattern is a single token.","For a single known object, use get-obj; for a range query use get-values-rng."],"exampleFix":"// before\nghidra trace get-values Processes[0].Threads[1] Registers\n// after\nghidra trace get-values Processes[0].Threads[].Registers[]","handlingStrategy":"validation","validationCode":"import shlex\n\ndef validate_get_values(command: str) -> None:\n    if len(shlex.split(command)) != 1:\n        raise ValueError('get-values needs exactly one PATTERN token')","typeGuard":"def is_pattern(tok: str) -> bool:\n    # patterns use [] wildcards or a trailing period\n    return '[]' in tok or tok.endswith('.')","tryCatchPattern":"try:\n    ghidra_trace_get_values(debugger, command, result, internal_dict)\nexcept RuntimeError as e:\n    if str(e).startswith('Usage:'):\n        result.SetError(str(e))\n    else:\n        raise","preventionTips":["Pass one PATTERN token using [] or trailing period for wildcards.","Use get-obj for a single object, get-values-rng for a memory range.","Quote patterns to keep them as one token."],"tags":["ghidra-trace","argument-validation","object-tree","cli-usage"],"backgroundTag":null,"analyzedSha":"d5f144c24d6bc53c9cbf4448c6d11143e7696206","analyzedAt":"2026-08-14T01:00:57.564Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}