Ghidra: the return type is not a measured result
A return type is a database field, not a value from a run. This page does not launch the program.
The return type is a field on the signature
The function signature has a return type. It may say int, void, or a type you have not narrowed yet. That word is stored on the function object. Changing it reprints the decompiler. It does not execute the program, and it does not record what a process returned.
This page stops at the field. It does not tell you to patch the return, and it does not open a debugger.
A return line belongs to one recovered path
The decompiler can print return and a constant on a path it recovered. A second path can print a different constant. Both lines are text generated from the instructions on those paths. Together they are not a single measured result, and the return type does not vote for one of them.
If you quote a return line, name the path. Quote the Listing branch that feeds it when you need a location, using the address from that row.
A run is a record you do not have yet
A measured result would be something you observed by running a program you are allowed to run, in a note that says the run happened. This lesson does not do that. If the notebook says the program returned a number, and the only source is the signature or one decompiler line, the sentence is ahead of the evidence.
Lab: int on the signature, two constants in the text
Pick a small lab function whose signature return type is an integer and whose decompiler shows two return lines with different constants. Write the type on one line. Write each recovered constant on its own line, tied to the path you can see.
Add an explicit line that no run was performed. Correct any draft that says the program returned the first constant. The type stays a type. The constants stay recovered text.
A signature and two recovered returns signature return type: int decompiler path A: return 0 decompiler path B: return 1 run: not performed write: type, and both recovered constants not: the program returned 0
Diagram
Three notes that are easy to collapse
The signature, a recovered return, and a run are different facts.
- Return type
The type on the function signature, such as int. A field in the database.
- One path
The decompiler may print return 0 on a single recovered path. That is text for that path.
- Another path
A second return can print a different constant. The type does not pick a winner.
- A run
Not taken on this page. There is no measured result to file.
signature return type: int decompiler path A: return 0 decompiler path B: return 1 run: not performed write: type, and both recovered constants not: the program returned 0
Check yourself
1. The function signature says int, and you have not run the program. What is int?
2. The decompiler shows return 0 on one path and return 1 on another. What can you say?
3. A teammate asks what the function returned when the lab machine ran it. What does this page support?