Skip to content

Link DWARF types only when prototypes match ##analysis #26455

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
trufae wants to merge 4 commits into
base: master
Choose a base branch
from
+397 −14
Open

Link DWARF types only when prototypes match ##analysis #26455

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
4bfc848
Link DWARF types only when prototypes match ##analysis
radare Aug 13, 2026
3534433
Preserve registered types when linking DWARF prototypes ##analysis
radare Aug 14, 2026
d42fd29
Replace stale fcnlink entries when a new DWARF type matches ##analysis
radare Aug 14, 2026
4b59227
Preserve and prefer exact DWARF function types ##analysis
radare Aug 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
83 changes: 69 additions & 14 deletions libr/anal/dwarf_process.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

#include <ctype.h>
#include <r_anal.h>
#include <r_anal_priv.h>
#include <r_bin_dwarf.h>

typedef struct dwarf_parse_context_t {
Expand All @@ -13,6 +14,7 @@ typedef struct dwarf_parse_context_t {
HtUP/*<offset, RBinDwarfLocList*>*/ *locations;
const char *lang; // for demangling
RArena *arena;
Sdb *pass_sdb;
} Context;

typedef struct dwarf_function_t {
Expand Down Expand Up @@ -1614,14 +1616,18 @@ static bool dwarf_function_type_matches(Sdb *types, const char *name, const char
return true;
}

static char *dwarf_function_type_name(Context *ctx, const char *sname, const Function *dwarf_fcn, const char *ret_type, RList/*<Variable*>*/ *variables, bool has_unspecified_parameters) {
static char *dwarf_function_type_name(Context *ctx, const char *sname, const Function *dwarf_fcn, const char *ret_type, RList/*<Variable*>*/ *variables, bool has_unspecified_parameters, bool seen_in_pass) {
R_RETURN_VAL_IF_FAIL (ctx && ctx->anal && sname && dwarf_fcn && ret_type && variables, NULL);
Sdb *types = ctx->anal->sdb_types;
const char *previous_name = sdb_const_getf (ctx->sdb, NULL, "fcn.%s.name", sname);
const char *previous = sdb_const_getf (ctx->sdb, NULL, "fcn.%s.typed_name", sname);
const ut64 previous_addr = sdb_num_getf (ctx->sdb, NULL, "fcn.%s.addr", sname);
if (previous_name && !strcmp (previous_name, dwarf_fcn->name)
&& previous && dwarf_function_type_matches (types, previous,
ret_type, variables, has_unspecified_parameters)) {
&& previous && previous_addr == dwarf_fcn->addr
&& (!seen_in_pass
|| dwarf_function_type_matches (types, previous, ret_type,
variables, has_unspecified_parameters)
|| sdb_const_getf (ctx->pass_sdb, NULL, "type.%s.quality", previous))) {
return strdup (previous);
}
char *name = sanitize_c_identifier (dwarf_fcn->name);
Expand Down Expand Up @@ -1731,7 +1737,10 @@ static void import_dwarf_function_type(Context *ctx, const char *sname, const ch
sdb_setf (ctx->sdb, csig, 0, "fcn.%s.csig", sname);
r_strbuf_fini (&args_buf);

if (!r_type_func_exist (anal->sdb_types, typed_name)) {
const char *pass_quality = sdb_const_getf (ctx->pass_sdb, NULL,
"type.%s.quality", typed_name);
const bool type_existed = !!sdb_const_get (anal->sdb_types, typed_name, 0);
if (!type_existed) {
/* Only attempt C parsing for C-like languages. Non-C languages
(Rust, Go, D, etc.) produce type names that are not valid C and
would choke the parser. Use the fallback which writes the same
Expand All @@ -1747,17 +1756,39 @@ static void import_dwarf_function_type(Context *ctx, const char *sname, const ch
}
free (errmsg);
}
if (!imported) {
if (!dwarf_function_type_matches (anal->sdb_types, typed_name,
ret_type, variables, has_unspecified_parameters)
&& r_type_func_exist (anal->sdb_types, typed_name)) {
/* The C importer can normalize a declaration into a different
prototype. Replace only the function record created above;
referenced or preexisting types remain registered. */
(void)r_anal_function_del_signature (anal, typed_name);
}
if (!r_type_func_exist (anal->sdb_types, typed_name)) {
(void)import_dwarf_function_fallback (anal, typed_name, ret_type, variables, has_unspecified_parameters);

@0verflowme 0verflowme Aug 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Withholding fcnlink does not prevent the rejected imported type from remaining in sdb_types. The name-based afs fallback can still display it

}
}
if (dwarf_fcn->prototype_complete && r_type_func_exist (anal->sdb_types, typed_name)) {
const char *linked = sdb_const_getf (anal->sdb_types, NULL,
"fcnlink.%08" PFMT64x, dwarf_fcn->addr);
if (!linked || !strcmp (linked, typed_name)) {
sdb_setf (anal->sdb_types, typed_name, 0,
"fcnlink.%08" PFMT64x, dwarf_fcn->addr);
if (r_type_func_exist (anal->sdb_types, typed_name)) {
sdb_setf (ctx->pass_sdb, dwarf_fcn->prototype_complete? "complete": "incomplete", 0,
"type.%s.quality", typed_name);
}
} else if (pass_quality && !strcmp (pass_quality, "incomplete")
&& dwarf_fcn->prototype_complete
&& !dwarf_function_type_matches (anal->sdb_types, typed_name,
ret_type, variables, has_unspecified_parameters)) {
/* Only a function record created by an inferior DIE in this pass is
replaceable. Registered and prior-pass types remain untouched. */
(void)r_anal_function_del_signature (anal, typed_name);
(void)import_dwarf_function_fallback (anal, typed_name, ret_type, variables, has_unspecified_parameters);
sdb_setf (ctx->pass_sdb, "complete", 0, "type.%s.quality", typed_name);
} else if (pass_quality && dwarf_fcn->prototype_complete) {
sdb_setf (ctx->pass_sdb, "complete", 0, "type.%s.quality", typed_name);
}
const bool type_matches = dwarf_fcn->prototype_complete
&& dwarf_function_type_matches (anal->sdb_types, typed_name,
ret_type, variables, has_unspecified_parameters);
if (type_matches) {
sdb_setf (anal->sdb_types, typed_name, 0,
"fcnlink.%08" PFMT64x, dwarf_fcn->addr);
}
free (csig);
}
Expand All @@ -1771,8 +1802,25 @@ static void sdb_save_dwarf_function(Context *ctx, Function *dwarf_fcn, const cha
free (real_name);
return;
}
const char *pass_name = sdb_const_getf (ctx->pass_sdb, NULL,
"fcn.%08" PFMT64x ".%s.name", dwarf_fcn->addr, sname);
const bool seen_in_pass = pass_name && !strcmp (pass_name, real_name);
const char *pass_quality = seen_in_pass
? sdb_const_getf (ctx->pass_sdb, NULL,
"fcn.%08" PFMT64x ".%s.quality", dwarf_fcn->addr, sname)
: NULL;
if (pass_quality && (!strcmp (pass_quality, "complete")
|| !dwarf_fcn->prototype_complete)) {
free (real_name);
free (sname);
return;
}
sdb_setf (ctx->pass_sdb, real_name, 0,
"fcn.%08" PFMT64x ".%s.name", dwarf_fcn->addr, sname);
sdb_setf (ctx->pass_sdb, dwarf_fcn->prototype_complete? "complete": "incomplete", 0,
"fcn.%08" PFMT64x ".%s.quality", dwarf_fcn->addr, sname);
char *typed_name = dwarf_function_type_name (ctx, sname, dwarf_fcn,
ret_type, variables, has_unspecified_parameters);
ret_type, variables, has_unspecified_parameters, seen_in_pass);
sdb_set (sdb, sname, "fcn", 0);

char *addr_val = r_str_newf ("0x%" PFMT64x, dwarf_fcn->addr);
Expand Down Expand Up @@ -2089,8 +2137,13 @@ static void parse_type_entry(Context *ctx, ut64 idx) {
*/
R_API void r_anal_dwarf_process_info(const RAnal *anal, RAnalDwarfContext *ctx) {
R_RETURN_IF_FAIL (ctx && anal);
r_anal_types_ensure_loaded ((RAnal *)anal);
Sdb *dwarf_sdb = sdb_ns (anal->sdb, "dwarf", 1);
sdb_unset_like (anal->sdb_types, "fcnlink.*");
Sdb *pass_sdb = sdb_new0 ();
if (!pass_sdb) {
return;
}

const RBinDwarfDebugInfo *info = ctx->info;
const RBinDwarfCompUnit *unit;
Expand All @@ -2104,13 +2157,15 @@ R_API void r_anal_dwarf_process_info(const RAnal *anal, RAnalDwarfContext *ctx)
.sdb = dwarf_sdb,
.locations = ctx->loc,
.lang = NULL,
.arena = arena
.arena = arena,
.pass_sdb = pass_sdb
};
R_VEC_FOREACH_I (unit->dies, j) {
parse_type_entry (&dw_context, j);
}
}
r_arena_free (arena);
sdb_free (pass_sdb);
}

bool filter_sdb_function_names(void *user, const char *k, const char *v) {
Expand Down
38 changes: 38 additions & 0 deletions test/db/formats/dwarf
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@ FILE=bins/elf/dwarf3_cpp.elf
CMDS=<<EOF
e asm.dwarf=false
aaa
k anal/types/fcnlink.00001169

@0verflowme 0verflowme Aug 14, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

There is no negative mismatch regression proving link absence, safe afs fallback, stable naming, and no type accumulation

afs @ 0x1169
k anal/types/fcnlink.0000130e
afs @ 0x130e
aaa
Expand All @@ -24,13 +26,49 @@ tl overridden = 0x130e
afs @ 0x130e
EOF
EXPECT=<<EOF
main_1169
int main_1169 ();
Bird_Bird_
void Bird_Bird_ (Bird * const this);
void Bird_Bird_ (Bird * const this);
int overridden (int x);
EOF
RUN

NAME="DWARF mismatch preserves registered type and stable name"
FILE=bins/elf/dwarf3_cpp.elf
ARGS=-e bin.dbginfo=false -e asm.dwarf=false
CMDS=<<EOF
t- fly
e bin.dbginfo=true
iddi
aaa
tf- fly
k anal/types/fly=func
k anal/types/func.fly.ret=FutureType *
k anal/types/func.fly.args=0
k anal/types/func.fly.cc=cdecl
k anal/types/func.fly=
iddi
aaa
k anal/dwarf/fcn.fly.typed_name
k anal/types/fcnlink.0000137a~?
afs @ 0x137a
iddi
k anal/dwarf/fcn.fly.typed_name
k anal/types/func.fly.ret
k anal/types/*~^fly_137a~?
EOF
EXPECT=<<EOF
fly
0
FutureType * fly ();
fly
FutureType *
0
EOF
RUN

NAME=test dwarf2
FILE=bins/elf/dwarf/hello-dwarf2
CMDS=<<EOF
Expand Down
Loading
Loading