Search code examples
ghidra

Ghidra decompile windows is greyed backgound


For some methods, Ghidra's decompiler background window is greyed out and I can't rename the function nor the local variables. Why?

It works fine for methods with a "white background".

Example:

Decompile window is greyed out

Matching code

        004d49dd cc              ??         CCh
        004d49de cc              ??         CCh
        004d49df cc              ??         CCh
                             LAB_004d49e0                                    XREF[1]:     FUN_004d4ac0:004d4b0e(*)  
  ==>   004d49e0 64 8b 0d        MOV        ECX,dword ptr FS:[0x2c]
                 2c 00 00 00
        004d49e7 a1 bc 39        MOV        EAX,[DAT_00d439bc]                               = ??
                 d4 00
        004d49ec 8b 14 81        MOV        EDX,dword ptr [ECX + EAX*0x4]
        004d49ef 8b 92 08        MOV        EDX,dword ptr [EDX + 0x8]
                 00 00 00

Solution

  • You can only do rename in a fully defined function. The grey background means that Ghidra didn't properly create a function at this point. You can see this also in a disassembly where you only have a label at this location. If you think this is a function you can type F and define a function. It should enable all the edit options.

    enter image description here