Ghidra After Crash



After a system crash, Ghidra greeted me with the message ```bash Unsupported file system schema: idata ``` when I tried to open the project. <span id="more-4771"></span> The only place in the source code that contains this error message is line 130 of `LocalFileSystem.java` ((<a href="https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Framework/FileSystem/src/main/java/ghidra/framework/store/local/LocalFileSystem.java#L130">source code on github</a>)). The corresponding exception only flies, if the function `hasAnyHiddenFiles` returns true. And this, in turn, only seems to happen, when there exists a file starting with `~`. I really want to pretend as if that helped me a lot. It did not. I finally decided to check out the project directory and look for files starting with `~` though. Changing into the `something.rep` directory and executing the following command showed me that there where two such files: ```bash $ find . -name '~*' -type f -printf '%s\t%p\n' 59 ./versioned/~index.bak 0 ./versioned/~index.dat 59 ./user/~index.dat 559 ./idata/~index.bak 0 ./idata/~index.dat ``` Interestingly they where empty, so I assumed they where not written correctly when Ghidra crashed. Thankfully there where two files ending in `.bak`, which are probably backup files. Overwriting the `.dat` files with the corresponding `.bak` files solved the problem for me #noideawhatiamdoing.

Tags: -

5 Replies to “Ghidra After Crash”

  1. This worked for me, thanks. After this you should get another Java error but click x to ignore the error and everything seems to work fine from there.
  2. See Ghidra ticket: https://github.com/NationalSecurityAgency/ghidra/issues/8870 The ~index.dat file (all `~` files for that matter) can be removed and project re-opened for the index files to regenerate. A system or application crash may have caused the index file write/flush to fail.

Leave a Reply

Your email address will not be published. Required fields are marked *