When patching a program and then using the export binary function, it turns the elf headers are corrupt.

Is there any way to work around this problem?


Ghidra Export Binary Feature

Note that the Binary export is not broken, it is simply misunderstood. This exporter simply dumps the initialized memory blocks defined within Ghidra in binary form. The blocks are appended sequentially. It was never intended to recreate a loadable/executable binary. While this is certainly a desirable feature, it does not yet exist within Ghidra.

"Official" Statement at https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-591596603

Patching and exporting a working executable

This is currently (April 2020) not supported in Ghidra itself and requires some external scripts/forks with some tradeoffs because in the most general sense you can't just turn an address space back into an executable file. But for the common case of patching instructions there are options:

PR/Fork that will possibly be upstreamed

There is a PR that is currently being worked on at https://github.com/NationalSecurityAgency/ghidra/pull/1505 that aims to implement binary patching

Ghidra Script

If building a custom fork is too much effort for a quick patch, another easier option is to use a script like https://github.com/schlafwandler/ghidra_SavePatch

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.