Ghidra Export Binary Feature

UPDATE AS OF June 2021:

The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021":

New exporters that write programs imported with the PE and ELF loaders back to their original file layout have been added. Any file-backed bytes that were modified by the user in the program database will be reflected in the written file. Bytes that are part of the import process such as relocations or modified Memory Maps are not currently handled.

https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html#L315-L318

As soon as Ghidra 10 is released this answer can be edited with the details of the process, but most likely it will just be similar to the current "exporter" that doesn't produce valid binary files.

Original (Outdated)

Note that the Binary export is not broken, it is simply misunderstood. This exporter simply dumps the initialized memory blocks defined within Ghidra in binary form. The blocks are appended sequentially. It was never intended to recreate a loadable/executable binary. While this is certainly a desirable feature, it does not yet exist within Ghidra.

"Official" Statement at https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.0_build/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html#L421-L424

Patching and exporting a working executable

This is currently (April 2020) not supported in Ghidra itself and requires some external scripts/forks with some tradeoffs because in the most general sense you can't just turn an address space back into an executable file. But for the common case of patching instructions there are options:

PR/Fork that will possibly be upstreamed

There is a PR that is currently being worked on at https://github.com/NationalSecurityAgency/ghidra/pull/1505 that aims to implement binary patching

Ghidra Script

If building a custom fork is too much effort for a quick patch, another easier option is to use a script like https://github.com/schlafwandler/ghidra_SavePatch

Ghidra Export Binary Feature

UPDATE AS OF June 2021:

The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021":

New exporters that write programs imported with the PE and ELF loaders back to their original file layout have been added. Any file-backed bytes that were modified by the user in the program database will be reflected in the written file. Bytes that are part of the import process such as relocations or modified Memory Maps are not currently handled.

https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.0_build/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html#L421-L424

As soon as Ghidra 10 is released this answer can be edited with the details of the process, but most likely it will just be similar to the current "exporter" that doesn't produce valid binary files.

Original (Outdated)

Note that the Binary export is not broken, it is simply misunderstood. This exporter simply dumps the initialized memory blocks defined within Ghidra in binary form. The blocks are appended sequentially. It was never intended to recreate a loadable/executable binary. While this is certainly a desirable feature, it does not yet exist within Ghidra.

"Official" Statement at https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-591596603

Patching and exporting a working executable

This is currently (April 2020) not supported in Ghidra itself and requires some external scripts/forks with some tradeoffs because in the most general sense you can't just turn an address space back into an executable file. But for the common case of patching instructions there are options:

PR/Fork that will possibly be upstreamed

There is a PR that is currently being worked on at https://github.com/NationalSecurityAgency/ghidra/pull/1505 that aims to implement binary patching

Ghidra Script

If building a custom fork is too much effort for a quick patch, another easier option is to use a script like https://github.com/schlafwandler/ghidra_SavePatch

Ghidra Export Binary Feature

UPDATE AS OF June 2021:

The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021":

New exporters that write programs imported with the PE and ELF loaders back to their original file layout have been added. Any file-backed bytes that were modified by the user in the program database will be reflected in the written file. Bytes that are part of the import process such as relocations or modified Memory Maps are not currently handled.

https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html#L315-L318

As soon as Ghidra 10 is released this answer can be edited with the details of the process, but most likely it will just be similar to the current "exporter" that doesn't produce valid binary files.

Original (Outdated)

Note that the Binary export is not broken, it is simply misunderstood. This exporter simply dumps the initialized memory blocks defined within Ghidra in binary form. The blocks are appended sequentially. It was never intended to recreate a loadable/executable binary. While this is certainly a desirable feature, it does not yet exist within Ghidra.

"Official" Statement at https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-591596603

Patching and exporting a working executable

This is currently (April 2020) not supported in Ghidra itself and requires some external scripts/forks with some tradeoffs because in the most general sense you can't just turn an address space back into an executable file. But for the common case of patching instructions there are options:

PR/Fork that will possibly be upstreamed

There is a PR that is currently being worked on at https://github.com/NationalSecurityAgency/ghidra/pull/1505 that aims to implement binary patching

Ghidra Script

If building a custom fork is too much effort for a quick patch, another easier option is to use a script like https://github.com/schlafwandler/ghidra_SavePatch

Ghidra Export Binary Feature

UPDATE AS OF June 2021:

The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021":

New exporters that write programs imported with the PE and ELF loaders back to their original file layout have been added. Any file-backed bytes that were modified by the user in the program database will be reflected in the written file. Bytes that are part of the import process such as relocations or modified Memory Maps are not currently handled.

https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html#L315-L318

As soon as Ghidra 10 is released this answer can be edited with the details of the process, but most likely it will just be similar to the current "exporter" that doesn't produce valid binary files.

Original (Outdated)

Note that the Binary export is not broken, it is simply misunderstood. This exporter simply dumps the initialized memory blocks defined within Ghidra in binary form. The blocks are appended sequentially. It was never intended to recreate a loadable/executable binary. While this is certainly a desirable feature, it does not yet exist within Ghidra.

"Official" Statement at https://github.com/NationalSecurityAgency/ghidra/blob/Ghidra_10.0_build/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html#L421-L424

Patching and exporting a working executable

This is currently (April 2020) not supported in Ghidra itself and requires some external scripts/forks with some tradeoffs because in the most general sense you can't just turn an address space back into an executable file. But for the common case of patching instructions there are options:

PR/Fork that will possibly be upstreamed

There is a PR that is currently being worked on at https://github.com/NationalSecurityAgency/ghidra/pull/1505 that aims to implement binary patching

Ghidra Script

If building a custom fork is too much effort for a quick patch, another easier option is to use a script like https://github.com/schlafwandler/ghidra_SavePatch

Ghidra Export Binary Feature

Note that the Binary export is not broken, it is simply misunderstood. This exporter simply dumps the initialized memory blocks defined within Ghidra in binary form. The blocks are appended sequentially. It was never intended to recreate a loadable/executable binary. While this is certainly a desirable feature, it does not yet exist within Ghidra.

"Official" Statement at https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-591596603

Patching and exporting a working executable

This is currently (April 2020) not supported in Ghidra itself and requires some external scripts/forks with some tradeoffs because in the most general sense you can't just turn an address space back into an executable file. But for the common case of patching instructions there are options:

PR/Fork that will possibly be upstreamed

There is a PR that is currently being worked on at https://github.com/NationalSecurityAgency/ghidra/pull/1505 that aims to implement binary patching

Ghidra Script

If building a custom fork is too much effort for a quick patch, another easier option is to use a script like https://github.com/schlafwandler/ghidra_SavePatch

Ghidra Export Binary Feature

UPDATE AS OF June 2021:

The preliminary release notes list this as a feature for Ghidra 10, which should be released "mid to end of June 2021":

New exporters that write programs imported with the PE and ELF loaders back to their original file layout have been added. Any file-backed bytes that were modified by the user in the program database will be reflected in the written file. Bytes that are part of the import process such as relocations or modified Memory Maps are not currently handled.

https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Configurations/Public_Release/src/global/docs/WhatsNew.html#L315-L318

As soon as Ghidra 10 is released this answer can be edited with the details of the process, but most likely it will just be similar to the current "exporter" that doesn't produce valid binary files.

Original (Outdated)

Note that the Binary export is not broken, it is simply misunderstood. This exporter simply dumps the initialized memory blocks defined within Ghidra in binary form. The blocks are appended sequentially. It was never intended to recreate a loadable/executable binary. While this is certainly a desirable feature, it does not yet exist within Ghidra.

"Official" Statement at https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-591596603

Patching and exporting a working executable

This is currently (April 2020) not supported in Ghidra itself and requires some external scripts/forks with some tradeoffs because in the most general sense you can't just turn an address space back into an executable file. But for the common case of patching instructions there are options:

PR/Fork that will possibly be upstreamed

There is a PR that is currently being worked on at https://github.com/NationalSecurityAgency/ghidra/pull/1505 that aims to implement binary patching

Ghidra Script

If building a custom fork is too much effort for a quick patch, another easier option is to use a script like https://github.com/schlafwandler/ghidra_SavePatch