3 ms·

You actually can, here's a video that shows how to do it: https://www.youtube.com/watch?v=8U6JOQnOOkg https://www.youtube.com/watch?v=8U6JOQnOOkg Tl;dr - pres

by dimb 7y ago

You actually can, here's a video that shows how to do it: https://www.youtube.com/watch?v=8U6JOQnOOkg https://www.youtube.com/watch?v=8U6JOQnOOkg Tl;dr - press Ctrl+Shift+G on the instruction you want to modify and it will outline the instruction in red, allowing you to modify it. That being said, it doesn't work for all architectures, and Ghidra will pop up with a rating box when you press Ctrl+Shift+G, explaining the compatibility/support for your current processor (for example, amd64 binaries are considered a "GOLD" rating, meaning there's an extremely high chance of your modification working correctly)

roblabla 7y ago
Patching actually works for every architecture, since it's backed by sleigh (and disassembly wouldn't even work without that). AFAIK, The problem (and the reason behind the popup) is that on some architecture, the sleigh might give ambiguous assembly instructions, so the assembler might not select the right instruction if there are multiple possibilities. But the biggest problem is, exporting a runable binary is not currently supported by Ghidra. Ghidra has a Binary Export function, but it's used as a sort of memory dump. It won't try to make a runnable program. This is by design, see issue #19[0]. It will probably work for RAW images, but that's it. Exporting a runnable binary is a highly desirable feature, though I can't find any issue tracking it. There's an open PR, #1505[1], that might provide people what they need. [0]: https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-591596603 https://github.com/NationalSecurityAgency/ghidra/issues/19#i... [1]: https://github.com/NationalSecurityAgency/ghidra/pull/1505 https://github.com/NationalSecurityAgency/ghidra/pull/1505
- john_alan 6y ago
  Yup this is exactly what I meant. I don’t understand why it’s not a feature. Surely it limits Ghidra significantly

by dimb 7y ago

roblabla 7y ago

Patching actually works for every architecture, since it's backed by sleigh (and disassembly wouldn't even work without that). AFAIK, The problem (and the reason behind the popup) is that on some architecture, the sleigh might give ambiguous assembly instructions, so the assembler might not select the right instruction if there are multiple possibilities. But the biggest problem is, exporting a runable binary is not currently supported by Ghidra. Ghidra has a Binary Export function, but it's used as a sort of memory dump. It won't try to make a runnable program. This is by design, see issue #19[0]. It will probably work for RAW images, but that's it. Exporting a runnable binary is a highly desirable feature, though I can't find any issue tracking it. There's an open PR, #1505[1], that might provide people what they need. [0]: https://github.com/NationalSecurityAgency/ghidra/issues/19#issuecomment-591596603 https://github.com/NationalSecurityAgency/ghidra/issues/19#i... [1]: https://github.com/NationalSecurityAgency/ghidra/pull/1505 https://github.com/NationalSecurityAgency/ghidra/pull/1505

john_alan 6y ago
Yup this is exactly what I meant. I don’t understand why it’s not a feature. Surely it limits Ghidra significantly