Export `binexport` file via command line next iteration

[githubaccount11001001]

Hi

as @wangshuai901 did a year ago, I am having the same issue (which was not resolved earlier, at least not documented). I would like to bulk binexport files for comparison with bindiff 6 for Ida7.1 in Windows 10. Bindiff and Binexport are working fine when used in the GUI. Therefore I created the ida db via 'idat64 -B test\x.exe'. When binexporting via GUI, 'bindiff --primary "e:\test\x.exe" --secondary "e:\test\y.exe" --output_format log' works fine. The only thing not working is binexport via command line. I tried

ida64.exe -A -SE:\test\bindiff_export.idc -OExport-Module:"e:\test\x.binexport" "E:\test\X.exe.i64"
ida64.exe -A -OBinExportAutoAction:BinExportBinary -OBinExport-Module:"e:\test\x.binexport" "E:\test\X.exe.i64"

with ida, ida64, idat and idat64, because @cblichmann wrote 'idat' was untested. Unfortunately, no binexport. Ida is not hanging, just not doing anything.

Contents of bindiff_export.idc:

#include <idc.idc>
static main()
{
  batch(0);
  auto_wait();
  qexit(1 - load_and_run_plugin("binexport10", 2));
}

I'm using Ida7.1 bindiff 6 with binexport10 (because 11 is not working with ida71). Could someone point me to what I'm doing wrong?

[cblichmann]

Hi there,

Thanks to idb_export.cc now also being open source, you can actually look into how BinDiff launches the export here.

First of all, you don't need the bindiff_export.idb script, the BinExportAutoAction:BinExportBinary part does that instead (BTW, you used "binexport10" in your script, which will not work. "binexport11" would be the correct one). Secondly, you have an extra hyphen in your command line arguments. And lastly, the way the file path is quoted will not work as intended. You either need to quote the whole argument, or not quote at all (if there's no space in the filename).

Putting it all together, the command line will look like this:

ida64.exe -A -OBinExportModule:E:\test\x.BinExport -OBinExportAutoAction:BinExportBinary E:\test\X.exe.i64

[githubaccount11001001]

Thank you very much! For pointing me to the code as well as the quotation hickup. And especially for the quick reaction.