When patching a program and then using the export binary function, it turns the elf headers are corrupt.
Is there any way to work around this problem?
Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.Sign up to join this community
Note that the Binary export is not broken, it is simply misunderstood. This exporter simply dumps the initialized memory blocks defined within Ghidra in binary form. The blocks are appended sequentially. It was never intended to recreate a loadable/executable binary. While this is certainly a desirable feature, it does not yet exist within Ghidra.
"Official" Statement at https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-591596603
This is currently (April 2020) not supported in Ghidra itself and requires some external scripts/forks with some tradeoffs because in the most general sense you can't just turn an address space back into an executable file. But for the common case of patching instructions there are options:
There is a PR that is currently being worked on at https://github.com/NationalSecurityAgency/ghidra/pull/1505 that aims to implement binary patching
If building a custom fork is too much effort for a quick patch, another easier option is to use a script like https://github.com/schlafwandler/ghidra_SavePatch