1

I am working on patch diffing using ghidra + bindiff (specifically, binexport), and am looking for advice on using bindiff with Ghidra headless.

ida_haru does essentially everything that I need, but for IDA instead of Ghidra. Specifically, I am wondering if something like the _make_BinExport() function exists for Ghidra.

def _make_BinExport(self, target, ida_path):
        binexp_path = self._get_db_path_noext(target) + '.BinExport'
        #binexp_path = os.path.splitext(target)[0] + '.BinExport'
        if not self._clear and os.path.exists(binexp_path):
            self._dprint('already existed BinExport: {}'.format(binexp_path))
            return 0

        #cmd = [ida_path, '-A', '-S{}'.format(g_exp_path), '-OExporterModule:{}'.format(binexp_path), target]  # the .BinExport filename should be specified in 4.3
        cmd = [ida_path, '-A', '-S{}'.format(g_exp_path), '-OBinExportModule:{}'.format(binexp_path), target]
        #print cmd
        
        self._dprint('getting BinExport for {}'.format(target))
        proc = subprocess.Popen(cmd, stdout=subprocess.PIPE, stderr=subprocess.PIPE)
        stdout, stderr = proc.communicate()
        return proc.returncode

Things I have done:

  1. ghidra headless script to get the func_names and min_addr for each function in the binaries,
  2. python script to work with the original_vs_patched.BinDiff files (sqlite3), and correlate results with the func_names

I'm missing:

  1. ghidra headless script to create and export the *.BinExport files

Advice and insights appreciated!

1
0

I have posted my solution GitHub https://github.com/Kayla0x41/ghidraheadless_binexport

The key is the following lines of code (to be used with Ghidra headless):

addr_set = currentProgram.getMemory()
f = File(program_name + '.BinExport')
exporter = BinExportExporter() #Binary BinExport (v2) for BinDiff
exporter.export(f, currentProgram, addr_set, monitor)

This line is used to export a sample_name.BinExport file for each sample analyzed, where sample_name is the name of the sample.

0

There are some additional imports required:

from com.google.security import binexport
import java.io.File as File

without which the codes will not work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.