Function not correctly decompiled: "funcboundflow: fall-through reached the next function entry; truncating flow here"

[dobin]

My main function doesnt get correctly decompiled.

https://github.com/dobin/redtest

See the ghidra-asm where the decompilation of kuna stops.

Kuna

Decompiled function which is too short:

// Function: sub_140002650 @ 0x140002650
void sub_140002650(void)
{
  unsigned short v1;
  unsigned long long v10; // stack - 0x20
  unsigned int v2; // eax
  char v3 [8];
  char v4 [96];
  char *v5; // rsp
  unsigned int v6; // stack - 0x30
  unsigned int v7; // stack - 0x2c
  unsigned int v8; // stack - 0x28
  unsigned int v9; // stack - 0x24
  
  v5 = v3;
  v10 = dat_140027000 ^ (unsigned long long)v3;
  sub_140001080("RedTest\n");
  v6 = *(unsigned int *)&dat_140027a88[-8];
  v7 = *(unsigned int *)&dat_140027a88[-6];
  v8 = *(unsigned int *)&dat_140027a88[-4];
  v9 = *(unsigned int *)&dat_140027a88[-2];
  if (dat_140027aa0) {
    (*(void *)swi(0x29))(5);
    v5 = v4;
  }
  dat_140027aa8 = 0;
  dat_140027ab0 = 0;
  *(unsigned long long *)&v5[-8] = 0x1400026c9;
  if (!EventRegister(&v5[0x68],sub_140001000,0x140027a80,0x140027aa0)) {
    v1 = *dat_140027a88;
    *(unsigned long long *)&v5[-8] = 0x1400026ea;
    EventSetInformation(dat_140027aa0,2,dat_140027a88,v1);
  }
  do {
    *(unsigned long long *)&v5[-8] = 0x1400026f1;
    v2 = sub_14000974c(0);
    *(unsigned long long *)&v5[-8] = 0x1400026f8;
    sub_1400094c8(v2);
    *(unsigned long long *)&v5[-8] = 0x140002702;
    dat_140028bc8 = sub_140009bd0();
  } while ; // warn: funcboundflow: fall-through reached the next function entry; truncating flow here
  *(unsigned long long *)&v5[-8] = 0x140002d77;
  sub_140002460("[!] Failed to allocate shellcode buffer");
  *(unsigned long long *)&v5[-8] = 0x140002d81;
  sub_140009490(1);
  (*(void *)swi(3))();
}

The function is way too small, and cut off. Probably } while ; // warn: funcboundflow: fall-through reached the next function entry; truncating flow here.

The functions ASM:

sub_140002650:  ; 0x140002650
; stack: v3 @ [stack-0x98] (char[8])
; stack: v4 @ [stack-0x90] (char[96])
; stack: v6 @ [stack-0x30] (unsigned int)
; stack: v7 @ [stack-0x2c] (unsigned int)
; stack: v8 @ [stack-0x28] (unsigned int)
; stack: v9 @ [stack-0x24] (unsigned int)
; stack: v10 @ [stack-0x20] (unsigned long long)
; stack: local_a0 @ [stack-0xa0] (undefined8)
; stack: local_8 @ [stack-0x8] (undefined8)
  140002650: 48 89 74 24 20            MOV        qword ptr [RSP + 0x20],RSI
  140002655: 57                        PUSH       RDI
  140002656: 48 81 ec 90 00 00 00      SUB        RSP,0x90
  14000265d: 48 8b 05 9c 49 02 00      MOV        RAX,qword ptr [0x140027000]
  140002664: 48 33 c4                  XOR        RAX,RSP
  140002667: 48 89 44 24 78            MOV        qword ptr [RSP + 0x78],RAX
  14000266c: 8b f1                     MOV        ESI,ECX
  14000266e: 48 8b fa                  MOV        RDI,RDX
  140002671: 48 8d 0d f8 10 02 00      LEA        RCX,[0x140023770]
  140002678: e8 03 ea ff ff            CALL       0x140001080
  14000267d: 48 83 3d 1b 54 02 00 00   CMP        qword ptr [0x140027aa0],0x0
  140002685: 48 8b 05 fc 53 02 00      MOV        RAX,qword ptr [0x140027a88]
  14000268c: 0f 10 40 f0               MOVUPS     XMM0, xmmword ptr [RAX + -0x10]
  140002690: 0f 11 44 24 68            MOVUPS     xmmword ptr [RSP + 0x68], XMM0
  140002695: 74 07                     JZ         0x14000269e
  140002697: b9 05 00 00 00            MOV        ECX,0x5
  14000269c: cd 29                     INT        0x29
  14000269e: 0f 57 c0                  XORPS      XMM0, XMM0
  1400026a1: 4c 8d 0d f8 53 02 00      LEA        R9,[0x140027aa0]
  1400026a8: 4c 8d 05 d1 53 02 00      LEA        R8,[0x140027a80]
  1400026af: 48 8d 15 4a e9 ff ff      LEA        RDX,[0x140001000]
  1400026b6: 48 8d 4c 24 68            LEA        RCX,[RSP + 0x68]
  1400026bb: f3 0f 7f 05 e5 53 02 00   MOVDQU     xmmword ptr [0x140027aa8], XMM0
  1400026c3: ff 15 37 79 01 00         CALL       qword ptr [0x14001a000]
  1400026c9: 85 c0                     TEST       EAX,EAX
  1400026cb: 75 1d                     JNZ        0x1400026ea
  1400026cd: 4c 8b 05 b4 53 02 00      MOV        R8,qword ptr [0x140027a88]
  1400026d4: ba 02 00 00 00            MOV        EDX,0x2
  1400026d9: 48 8b 0d c0 53 02 00      MOV        RCX,qword ptr [0x140027aa0]
  1400026e0: 45 0f b7 08               MOVZX      R9D,word ptr [R8]
  1400026e4: ff 15 1e 79 01 00         CALL       qword ptr [0x14001a008]
  1400026ea: 33 c9                     XOR        ECX,ECX
  1400026ec: e8 5b 70 00 00            CALL       0x14000974c
  1400026f1: 8b c8                     MOV        ECX,EAX
  1400026f3: e8 d0 6d 00 00            CALL       0x1400094c8
  1400026f8: b9 00 90 01 00            MOV        ECX,0x19000
  1400026fd: e8 ce 74 00 00            CALL       0x140009bd0
  140002702: 48 89 05 bf 64 02 00      MOV        qword ptr [0x140028bc8],RAX
  140002709: 48 85 c0                  TEST       RAX,RAX
  14000270c: 0f 84 59 06 00 00         JZ         0x140002d6b

sub_140002712:  ; 0x140002712
  140002712: 48 89 9c 24 a0 00 00 00   MOV        qword ptr [RSP + 0xa0],RBX
  14000271a: 48 89 ac 24 b0 00 00 00   MOV        qword ptr [RSP + 0xb0],RBP
  140002722: 33 ed                     XOR        EBP,EBP
  140002724: 8b dd                     MOV        EBX,EBP

Ghidra

Ghidra was able to decompile it correctly:

/* WARNING: Function: __security_check_cookie replaced with injection: security_check_cookie */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
undefined8 FUN_140002650(int param_1,ulonglong *param_2,undefined8 param_3,undefined8 param_4)
{
  REGHANDLE RegHandle;
  ULONG UVar1;
  uint uVar2;
  DWORD DVar3;
  longlong lVar4;
  HMODULE pHVar5;
  SIZE_T SVar6;
  HANDLE pvVar7;
  LPVOID lpAddress;
  HMODULE pHVar8;
  char *pcVar9;
  char *pcVar10;
  code *pcVar11;
  void *pvVar12;
  IMAGE_DOS_HEADER *pIVar13;
  undefined8 unaff_RBX;
  ulonglong uVar14;
  undefined1 *puVar15;
  undefined8 unaff_RBP;
  undefined4 *puVar16;
  undefined8 uVar17;
  LPVOID pvVar18;
  undefined8 *puVar19;
  undefined4 unaff_XMM6_Da;
  undefined4 unaff_XMM6_Db;
  undefined4 unaff_XMM6_Dc;
  undefined4 unaff_XMM6_Dd;
  undefined1 auStack_98 [8];
  undefined1 auStack_90 [96];
  undefined4 local_30;
  undefined4 uStack_2c;
  undefined4 uStack_28;
  undefined4 uStack_24;
  ulonglong local_20;
  
  puVar15 = auStack_98;
  local_20 = DAT_140027000 ^ (ulonglong)auStack_98;
  FUN_140001080(0x140023770,param_2,param_3,param_4);
  local_30 = *(undefined4 *)(PTR_DAT_140027a88 + -0x10);
  uStack_2c = *(undefined4 *)(PTR_DAT_140027a88 + -0xc);
  uStack_28 = *(undefined4 *)(PTR_DAT_140027a88 + -8);
  uStack_24 = *(undefined4 *)(PTR_DAT_140027a88 + -4);
  if (DAT_140027aa0 != 0) {
    pcVar11 = (code *)swi(0x29);
    (*pcVar11)(5);
    puVar15 = auStack_90;
  }
  puVar19 = &DAT_140027aa0;
  puVar16 = &DAT_140027a80;
  pcVar11 = FUN_140001000;
  _DAT_140027aa8 = 0;
  uRam0000000140027ab0 = 0;
  *(undefined8 *)(puVar15 + -8) = 0x1400026c9;
  UVar1 = EventRegister((LPCGUID)(puVar15 + 0x68),FUN_140001000,&DAT_140027a80,&DAT_140027aa0);
  if (UVar1 == 0) {
    pcVar11 = (code *)0x2;
    puVar19 = (undefined8 *)(ulonglong)*(ushort *)PTR_DAT_140027a88;
    *(undefined8 *)(puVar15 + -8) = 0x1400026ea;
    puVar16 = (undefined4 *)PTR_DAT_140027a88;
    EventSetInformation();
  }
  *(undefined8 *)(puVar15 + -8) = 0x1400026f1;
  lVar4 = FUN_14000974c((longlong *)0x0);
  *(undefined8 *)(puVar15 + -8) = 0x1400026f8;
  FUN_1400094c8((int)lVar4);
  *(undefined8 *)(puVar15 + -8) = 0x140002702;
  DAT_140028bc8 = _malloc_base(0x19000);
  if (DAT_140028bc8 == (undefined1 *)0x0) {
    *(undefined8 *)(puVar15 + -8) = 0x140002d77;
    FUN_140002460(0x140023718,pcVar11,puVar16,puVar19);
    *(undefined8 *)(puVar15 + -8) = 0x140002d81;
    FUN_140009490(1);
    pcVar11 = (code *)swi(3);
    uVar17 = (*pcVar11)();
    return uVar17;
  }
...

The relevant ASM:

140002650  MOV qword ptr [RSP + 0x20],RSI
140002655  PUSH RDI
140002656  SUB RSP,0x90
14000265d  MOV RAX,qword ptr [0x140027000]
140002664  XOR RAX,RSP
140002667  MOV qword ptr [RSP + 0x78],RAX
14000266c  MOV ESI,ECX
14000266e  MOV RDI,RDX
140002671  LEA RCX,[0x140023770]
140002678  CALL 0x140001080
14000267d  CMP qword ptr [0x140027aa0],0x0
140002685  MOV RAX,qword ptr [0x140027a88]
14000268c  MOVUPS XMM0,xmmword ptr [RAX + -0x10]
140002690  MOVUPS xmmword ptr [RSP + 0x68],XMM0
140002695  JZ 0x14000269e
140002697  MOV ECX,0x5
14000269c  INT 0x29
14000269e  XORPS XMM0,XMM0
1400026a1  LEA R9,[0x140027aa0]
1400026a8  LEA R8,[0x140027a80]
1400026af  LEA RDX,[0x140001000]
1400026b6  LEA RCX,[RSP + 0x68]
1400026bb  MOVDQU xmmword ptr [0x140027aa8],XMM0
1400026c3  CALL qword ptr [0x14001a000]
1400026c9  TEST EAX,EAX
1400026cb  JNZ 0x1400026ea
1400026cd  MOV R8,qword ptr [0x140027a88]
1400026d4  MOV EDX,0x2
1400026d9  MOV RCX,qword ptr [0x140027aa0]
1400026e0  MOVZX R9D,word ptr [R8]
1400026e4  CALL qword ptr [0x14001a008]
1400026ea  XOR ECX,ECX
1400026ec  CALL 0x14000974c
1400026f1  MOV ECX,EAX
1400026f3  CALL 0x1400094c8
1400026f8  MOV ECX,0x19000
1400026fd  CALL 0x140009bd0
140002702  MOV qword ptr [0x140028bc8],RAX
140002709  TEST RAX,RAX
14000270c  JZ 0x140002d6b

<-- kuna cuts off here --> 

140002712  MOV qword ptr [RSP + 0xa0],RBX
14000271a  MOV qword ptr [RSP + 0xb0],RBP
140002722  XOR EBP,EBP
140002724  MOV EBX,EBP
140002726  MOVAPS xmmword ptr [RSP + 0x80],XMM6
14000272e  NOP
140002730  CALL 0x14000949c
....

[mahaloz]

Fixed — it took two changes, in #409 and #410.

The trigger was function discovery, not the decompiler. kuna seeded a function at every .pdata RUNTIME_FUNCTION BeginAddress without ever reading the UNWIND_INFO the third dword points at. MSVC splits one function across several records for shrink-wrapped and separated code, and every record after the first carries UNW_FLAG_CHAININFO — those are points inside a function. So 0x140002712 became sub_140002712, and funcboundflow correctly refused to run one function's flow into another's entry. Ghidra skips chained records for the same reason (ImageRuntimeFunctionEntries_X86).

The second half was ours regardless: the artificial no-return RETURN that the truncation plants landed inside the conditional branch's own basic block, so the branch's fall-through resolved back to that block. That self-edge is what rendered as } while ; — which, as you noticed, is not valid C. On a loop shape it collapsed both out-edges onto one block and killed the decompile outright.

On the synthetic reproduction of your shape:

before:  0x140001000  0x140001020  0x140001040     <- three "functions"
         do { } while ; // warn: funcboundflow: ...

after:   0x140001000  0x140001040
         int sub_140001000(int a0)
         { if (a0 != -0xf) return a0 + 0x16; return 99; }

--option pdatachained off restores the old discovery set if you ever need it.

Two things worth knowing. The same walk hard-coded a 12-byte record stride, so every ARM/ARM64 PE had its whole .pdata table misparsed — that is fixed too, and it is not gated. And there is a small residual: a chained fragment reachable only through an SEH unwind, never by a jump or fall-through from its primary, now stays inside the primary's extent but stops being decompiled on its own. Measured at 48 bytes across one 461-function image; the option turns it off.

Thanks for the report — the disassembly next to Ghidra's output made this straightforward to pin down without the binary.

[mahaloz]

Human zion here, looks like this really is fixed. Thanks for the report :)