3 ms·

I agree, my only issue with Ghidra is that you can't patch and then export a modified binary, which you can do in IDA. You haven't been able to work-around tha

I agree, my only issue with Ghidra is that you can't patch and then export a modified binary, which you can do in IDA. You haven't been able to work-around that have you?

dimb 7y ago
You actually can, here's a video that shows how to do it: https://www.youtube.com/watch?v=8U6JOQnOOkg https://www.youtube.com/watch?v=8U6JOQnOOkg Tl;dr - press Ctrl+Shift+G on the instruction you want to modify and it will outline the instruction in red, allowing you to modify it. That being said, it doesn't work for all architectures, and Ghidra will pop up with a rating box when you press Ctrl+Shift+G, explaining the compatibility/support for your current processor (for example, amd64 binaries are considered a "GOLD" rating, meaning there's an extremely high chance of your modification working correctly)
- roblabla 7y ago
  Patching actually works for every architecture, since it's backed by sleigh (and disassembly wouldn't even work without that). AFAIK, The problem (and the reason behind the popup) is that on some architecture, the sleigh might give ambiguous assembly instructions, so the assembler might not select the right instruction if there are multiple possibilities. But the biggest problem is, exporting a runable binary is not currently supported by Ghidra. Ghidra has a Binary Export function, but it's used as a sort of memory dump. It won't try to make a runnable program. This is by design, see issue #19[0]. It will probably work for RAW images, but that's it. Exporting a runnable binary is a highly desirable feature, though I can't find any issue tracking it. There's an open PR, #1505[1], that might provide people what they need. [0]: https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-591596603 https://github.com/NationalSecurityAgency/ghidra/issues/19#i... [1]: https://github.com/NationalSecurityAgency/ghidra/pull/1505 https://github.com/NationalSecurityAgency/ghidra/pull/1505
  - john_alan 7y ago
    Yup this is exactly what I meant. I don’t understand why it’s not a feature. Surely it limits Ghidra significantly
souprock 7y ago
The real winner for that is probably Binary Ninja. It has a built-in compiler that is well-suited for patching binaries.

I agree, my only issue with Ghidra is that you can't patch and then export a modified binary, which you can do in IDA. You haven't been able to work-around that have you?

dimb 7y ago

You actually can, here's a video that shows how to do it: https://www.youtube.com/watch?v=8U6JOQnOOkg https://www.youtube.com/watch?v=8U6JOQnOOkg Tl;dr - press Ctrl+Shift+G on the instruction you want to modify and it will outline the instruction in red, allowing you to modify it. That being said, it doesn't work for all architectures, and Ghidra will pop up with a rating box when you press Ctrl+Shift+G, explaining the compatibility/support for your current processor (for example, amd64 binaries are considered a "GOLD" rating, meaning there's an extremely high chance of your modification working correctly)

roblabla 7y ago
Patching actually works for every architecture, since it's backed by sleigh (and disassembly wouldn't even work without that). AFAIK, The problem (and the reason behind the popup) is that on some architecture, the sleigh might give ambiguous assembly instructions, so the assembler might not select the right instruction if there are multiple possibilities. But the biggest problem is, exporting a runable binary is not currently supported by Ghidra. Ghidra has a Binary Export function, but it's used as a sort of memory dump. It won't try to make a runnable program. This is by design, see issue #19[0]. It will probably work for RAW images, but that's it. Exporting a runnable binary is a highly desirable feature, though I can't find any issue tracking it. There's an open PR, #1505[1], that might provide people what they need. [0]: https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-591596603 https://github.com/NationalSecurityAgency/ghidra/issues/19#i... [1]: https://github.com/NationalSecurityAgency/ghidra/pull/1505 https://github.com/NationalSecurityAgency/ghidra/pull/1505
- john_alan 7y ago
  Yup this is exactly what I meant. I don’t understand why it’s not a feature. Surely it limits Ghidra significantly

souprock 7y ago

The real winner for that is probably Binary Ninja. It has a built-in compiler that is well-suited for patching binaries.