How to change function signature for external function via ghidra java script

[Nicholas-wei]

I want to edit the function signature of an external function in ghidra using ghidra java script. For example, I want to edit the function nvram_get signature to char* nvram_get(char*). However, the following code doesn't work.

I have referenced the following blog, but no one helps
#5516
#1126

Can anyone provide some hint on how to edit external function signature ? Any help is appreciated!

public void fixKnownFuncSignature() {
        // reference: https://gist.github.com/crashingstatic/71f9ca586e43178fbea3317a93e1df59
        
        // change UNDIFINED nvram_get() TO char* nvram_get(char*)
        int transactionID = currentProgram.startTransaction("Fix Function Signature");
        boolean commit = false;
        Function nvram_get = getSingleFunctionWithName("nvram_get");
        if(nvram_get != null) {
	        ProgramBasedDataTypeManager dataTypeManager = currentProgram.getDataTypeManager();
	        DataType charPtrType = new PointerDataType(dataTypeManager.getDataType("/char"));
	        // Create an array of ParameterDefinition for the new signature
	        ParameterDefinition[] params = new ParameterDefinition[] {
	            new ParameterDefinitionImpl("name", charPtrType, "Array of arguments"),
	        };
	        Category rootCategory = dataTypeManager.getRootCategory();
	        CategoryPath categoryPath = rootCategory.getCategoryPath();
	        FunctionDefinitionDataType returnType = new FunctionDefinitionDataType(categoryPath, "nvram_get");
	        returnType.setReturnType(charPtrType); // Set the return type separately
	        returnType.setArguments(params);    // Set the parameter list
	        FunctionSignature newSignature = returnType;
	        
	        SourceType source = SourceType.IMPORTED;
	        ApplyFunctionSignatureCmd cmd = new ApplyFunctionSignatureCmd(nvram_get.getEntryPoint(), newSignature, source);
	        boolean success2 = cmd.applyTo(currentProgram);
	        boolean success = runCommand(cmd);
	        
	        // success and success2 are both True
	        if(success) {
	         println("Function signature nvram_get fixed successfully.");
	         commit = true;
	        }else {
	         println("Function signature nvram_get not fixed");
	         commit = false;
	        }
	      
}
currentProgram.endTransaction(transactionID, commit);

// testing
ProgramBasedDataTypeManager dataTypeManager = currentProgram.getDataTypeManager();
Category rootCategory = dataTypeManager.getRootCategory();
CategoryPath categoryPath = rootCategory.getCategoryPath();

// Now, the returnType2 is not changed
FunctionDefinitionDataType returnType2 = new FunctionDefinitionDataType(categoryPath, "nvram_get");
println();
        
	}

[ReversingWithMe]

This post is a bit old, and maybe already solved, but here is one way to do it, although this feels less elegant than the way you wanted, you can easily wrap this in a transaction as well I believe.

Standard decompiler interface, and getting handle to function

handle to decomp interface from currentProgram

private DecompInterface setupDecompiler(Program program)
        throws DecompileException {
        DecompileOptions options = new DecompileOptions();
        DecompInterface ifc = new DecompInterface();
        ifc.setOptions(options);

        if (!ifc.openProgram(program)) {
            throw new DecompileException(
                "Decompiler",
                "Unable to initialize: " + ifc.getLastMessage()
            );
        }
        ifc.setSimplificationStyle("decompile"); //this gives us HighVar names

        return ifc;
    }

handle to function from function name, and handle to functionmanager from current function

FunctionManager functionManager = program.getFunctionManager();

private Function getFunctionByName(
        FunctionManager functionManager,
        String functionName
    ) {
        boolean FUNCTION_FORWARD = true;

        for (Function func : functionManager.getFunctions​(FUNCTION_FORWARD)) {
            // println("Current Function Name: " + func.getName() + " Looking for " + functionName);
            if (func.getName().equals(functionName)) {
                return func;
            }
        }
        return null;
    }

Actual logic you may want?

private void updateExtFunction(DecompInterface ifc, Function extFunc) {
        try {
            HighFunction highFunction = ifc
                .decompileFunction(extFunc, 30, monitor)
                .getHighFunction();
            HighFunctionDBUtil.commitParamsToDatabase(
                highFunction,
                true,
                ReturnCommitOption.COMMIT_NO_VOID, // or COMMIT, NO_COMMIT
                SourceType.ANALYSIS
            );

            DataTypeManager dtm = currentProgram.getDataTypeManager();
            PointerDataType charPtr = new PointerDataType(
                CharDataType.dataType,
                dtm
            );
            PointerDataType charPtrPtr = new PointerDataType(charPtr, dtm);
            DataType intDataType = IntegerDataType.dataType;

            // Convert existing params to list
            Parameter[] existing = extFunc.getParameters();
            List<Parameter> newParams = new ArrayList<>();

            // Copy and modify existing param if it exists
            Parameter p0 = existing[0];
            p0.setDataType(charPtrPtr, SourceType.USER_DEFINED);
            p0.setName("arg1", SourceType.USER_DEFINED);
            newParams.add(p0);

            Parameter p1 = existing[1];
            p1.setDataType(intDataType, SourceType.USER_DEFINED);
            p1.setName("arg2", SourceType.USER_DEFINED);
            newParams.add(p1);

            // Add a new third param
            Parameter p2 = new ParameterImpl(
                "arg3",
                intDataType,
                currentProgram
            );
            newParams.add(p2);

            // Replace parameters on function
            extFunc.replaceParameters(
                newParams,
                Function.FunctionUpdateType.DYNAMIC_STORAGE_ALL_PARAMS,
                true, // Force
                SourceType.USER_DEFINED
            );

            println(" [INFO]  Updated function parameters for 'external'");
        } catch (Exception e) {
            println(
                "[ERROR]  Failed to update function parameters for external: " +
                e.getMessage()
            );
        }
    }

[ReversingWithMe]

If you specifically want to modify the return type. This doesn't make ghidra use the return type so if the user code does not utilize it telling ghidra there is a return there wont change the decomp. e.g., if you change read return type, and the number of bytes read isn't used, then the return type wont matter I believe.

Under same function as "Logic you may want?"

...
// Replace parameters on function
extFunc.replaceParameters(
    newParams,
    Function.FunctionUpdateType.DYNAMIC_STORAGE_ALL_PARAMS,
    true, // Force
    SourceType.USER_DEFINED
);

// Set return type to `int`
extFunc.setReturnType(
    intDataType, // New return type
    SourceType.USER_DEFINED // Mark it as user-specified
);