Skip to content

fix: analyze durably during one-shot import (functions lost after import) - #21

Open
maci0 wants to merge 1 commit into
akiselev:masterfrom
maci0:fix/import-durable-analysis
Open

fix: analyze durably during one-shot import (functions lost after import)#21
maci0 wants to merge 1 commit into
akiselev:masterfrom
maci0:fix/import-durable-analysis

Conversation

@maci0

@maci0 maci0 commented Aug 29, 2026

Copy link
Copy Markdown

Problem

After ghidra-cli import, a fresh session sees the imported program as un-analyzed: program list reports "analyzed":false, function_count:0 and function list / decompile return nothing — even though import printed "Analyzing… Analysis complete!" with function_count: 121.

Root cause

The project bootstrap (src/ghidra/bridge.rs::import_oneshot) launches analyzeHeadless -import <binary> **-noanalysis** -overwrite. Analysis is deliberately skipped at launch and driven later over TCP (handleAnalyze), whose currentProgram.save("Analysis complete", mon) is wrapped in a catch-all:

try {
    currentProgram.save("Analysis complete", mon);
} catch (Exception saveErr) {
    // Best effort - durable persistence also happens on clean shutdown.
}

When that save fails (the bridge opens the program in -process mode where in-place save is not durable), the exception is swallowed — the analyzed program never reaches the project DB, and every later session opens the un-analyzed program.

Fix

Remove -noanalysis from import_oneshot. analyzeHeadless -import analyzes and persists the analyzed program to the project on exit, so query sessions open an already-analyzed program and see the functions. This eliminates the fragile TCP-analyze + best-effort-save path for the common bootstrap case (the bridge still launches with -process -noanalysis so it never re-analyzes).

Verification

analyzeHeadless -import (no -noanalysis) on mini_pe.exe, then a separate -process mini_pe.exe -noanalysis session with a count script reports FUNCTION_COUNT=2 — the analysis persisted across sessions. cargo build --release passes.

…ort)

The project bootstrap (analyzeHeadless -import) passed -noanalysis and
relied on the bridge's best-effort program.save() after a TCP analyze.
That save silently swallows failures, so a fresh session saw the imported
program as un-analyzed (analyzed:false, function_count:0) even though
import reported 'Analysis complete', and function list/decompile returned
nothing.

Analyze inside the one-shot import instead: analyzeHeadless persists the
analyzed program on exit, so query sessions see the functions.

Verified with analyzeHeadless: import (without -noanalysis) persists
FUNCTION_COUNT=2 for mini_pe.exe across separate sessions.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant