How to automate function return-type casting based on its sole input parameter?

[michael-g]

I'm reviewing some multi-threaded code which makes use of thread-local storage. I would like to be able to update all the instances in the Decompiler view where the call to __tls_get_addr is passed one memory address in particular, such that just these results are cast to a custom struct pointer. Doing this manually is theoretically possible, but there has to be another way.

Has this functionality already been developed for Ghidra? If not, what approach should I take, and is there any similar prior art I could use as a crib?

[ZX41R]

There is a built-in mechanism that is close to what you want: a decompiler call-site prototype override. In the UI it is the Override Signature action. Under the hood it writes an override for one call instruction, not for the callee globally, via HighFunctionDBUtil.writeOverride(function, callsite, functionSignature).

For automation I would not try to change __tls_get_addr itself, because the return type is intentionally call-site dependent in your case. The usual shape is:

1. Open a DecompInterface and decompile each function.
2. Get DecompileResults.getHighFunction().
3. Walk the PcodeOpAST ops and find CALL ops whose destination resolves to __tls_get_addr.
4. Inspect the argument varnode. If it is a constant/address expression matching the TLS descriptor you care about, build a FunctionDefinitionDataType with the same calling convention/params but with return type my_struct *.
5. Commit that signature at op.getSeqnum().getTarget() with HighFunctionDBUtil.writeOverride(...).
6. Flush/decompile again.

That gives you a localized decompiler result without lying about the prototype of __tls_get_addr everywhere else in the program.

The awkward part is step 4: depending on the architecture and relocation model, the argument may not be a bare constant. It may be a PTRSUB / PTRADD chain or a load from a TLS descriptor. I would first script it to add a plate comment/bookmark at the matching call sites, verify that your matcher finds exactly the right addresses, and only then have the same script write the overrides.

[michael-g]

Thank you! I'm finally able to give this a try.