Importing executable files with auto-detected format exports corrupted binaries

[rszibele]

Describe the bug
If you import an ELF binary with the format as Executable and Linking Format (ELF) and then export that binary, it creates a corrupted binary that segfaults.

However, if you import it as "Raw binary" and manually select the language, then the exported file works as expected.

To Reproduce
Steps to reproduce the behavior:

1. Import the cp ELF binary into your project (default settings).
2. Right-Click it and click Export...
3. Select Binary as the format.
4. Export it.
5. Make the exported binary executable.
6. Run the exported binary.

Expected behavior
The exported binary should work instead of segfaulting (happens with multiple binaries that I've tested).

Screenshots
Default:

Import as Raw binary:

Environment (please complete the following information):

• OS: Kubuntu 18.10
• Ghira Version 9.0

Additional context
Happens with both i386 and x86_64 binaries.

[woachk]

Issue affects ARM binaries too.

[rszibele]

Just tested it on Windows and it's the same story with PE executables. They also need to be imported raw, else you can't run them.

[Ristovski]

Can confirm. The exported ls becomes ~3kb larger than the original.
Some binaries also end up with missing headers.

[Ristovski]

Note: Loading as Raw Binary does not seem to produce the same analysis/disassembly output at all.

The disassembly after analysis is missing various things ranging from functions not being disassembled to missing Xrefs.

It also appears to analyze the binary much faster than when imported as ELF indicating it is either unable to analyze is as thoroughly when loaded as a Raw Binary or just skips a bunch of analysis options which are enabled/supported only under ELF.

Thus, loading as Raw Binary should not be considered a workaround for this as the output differs.

The binary export is not intended to create a valid executable - there is no export for doing this. It simply dumps the memory blocks that exist within Ghidra void of any address placement information.

[Ristovski]

@gnooby22 Would be nice if there was a way to imitate the behavior when loading a binary as Raw Binary (which when exported creates a valid verbatim copy of the loaded program) but retaining all the analysis options when loading it as ELF.

One would expect that Export Program as Binary would create a valid executable when loaded as ELF as well.

This means that executables as of now can't be nicely patched like in IDA.

[bratao]

Yeah,
Working exported binaries is a very important feature for many workflows.

[Corallo]

Once I imported as Raw Binary what can I do to produce the same binary analysis of an ELF? At least to automatically show assembly code.

[Ristovski]

@Corallo It sadly does not seem to be possible as of now

[johnalanwoods]

Also have this issue.

When I make patches to apps, I can't export a binary without seg fault, nor does it make the change to the underlying binary referenced by the project.