Ghidra: saving, archives, and a shared project

Save commits the open program

While CodeBrowser is open, your renames and comments are transactions on the in-memory program. File > Save Program writes them into the project repository. The tool will also ask when you close a program that has unsaved transactions. Undo and redo walk those transactions inside the session, including the transaction a script made. After a crash, or after you decline the save prompt, the project still holds the last save and nothing since. There is no silent second copy inside the executable.

Get into the habit of saving at the end of a lab section, when a small batch of names has settled, and before you run a long analyzer you might want to undo. A save is a point you can return to by ordinary discipline. It is not a version-control history. A local project does not keep every previous save. If you need that stack, you either export a zip at the milestone or you use a shared project’s check-in history.

A zip of one program, a copy of the whole project

File > Export Program offers several formats. The one that carries the analysis is the Ghidra Zip File, extension .gzf. It holds the program database: bytes as imported, names, comments, bookmarks, types, and function objects. Another person imports it into their project and sees your work. Exporting as a raw binary or as an ELF would be a different choice, and this lesson does not use it. Stay with the zip when the goal is to move the reading.

To back up the whole project, close Ghidra and copy the project directory, marker and repository together. Copying the repository while the tool has it open can capture a half-written file. The executables you studied should sit outside that directory, named and dated, so a restore of the project does not depend on a restore of the samples, and a delete of the samples does not take the notes with it.

Checkout is the team’s unit of work

A shared project connects to a Ghidra Server. The administrator runs the server. The default port is 13100 unless they changed it. You create the project with File > New Project > Shared Project and the host they gave you. Programs are added to version control. To edit one, you check it out. The checkout is the write lock: you are the writer, other people can still read the last checked-in version, and they do not edit underneath you. When you check in, you write a comment that says what the version contains, the same way you would for source control. View History lists those versions.

The lab log is still outside the tool. A check-in comment of “updates” helps no one. A comment of “named main and load_config on the stripped -O0 build, Warning bookmark on the status jump” is a handoff. Keep hostile samples and their projects on the isolated machine. Do not check a malware database into a server that also holds ordinary class work. The server is a copy of the bytes plus your notes, and the copy belongs where the sample is allowed to be.

• Save the program before you close it.
• Export a .gzf when a person needs one named database.
• Copy a local project directory only while the project is closed.
• On a server, check out, edit, check in with a comment that states the decisions.

Lab: save, export, and reopen the archive

Confirm the names and bookmarks from the earlier labs are on screen. Save the program. Export it as a Ghidra zip into the lab directory, outside the project folder, with a name that includes the build, such as harbor-check-o0-named.gzf. Create a second non-shared project, import the zip, and open the program. main, load_config, the plate comment, and the bookmarks should be there. The original executable’s modification time should be unchanged from the compile.

Write the log line in the sample. If you have a second machine or a classmate’s project to try the shared workflow, add the program to a repository, check it out, change one comment, check it in, and have the other person update. If you do not, the zip import is the whole handoff, and it is enough.

A lab log line that outlives the tool

date, your name
program: harbor-check-o0
language: x86:LE:64:default / gcc
saved: names for main, load_config, status_text
open question: none, or the Warning bookmark you still owe
executable on disk: not modified