Is it possible to save the analyzed state and reuse it?

[anzosasuke]

Using a headless, is it possible to save the state of analysis phase somewhere so as if i have to change my postscript, i don't need to redo the analysis phase. I am working with big binaries and it takes a lot of time if i have to change something with my script. I was wondering if there is a way to do in a way i can save time for this process. Any insights on this would be greatly appreciated.

[ryanmkurtz]

Unless you specified the -noanalysis command line argument, your binaries imported via headless should get analyzed and saved. Is that what you are asking?

[anzosasuke]

Thanks for replying. I don't have any -noanalysis.
let's say if i run analysis using-
Command= analyzeHeadless ~/Documents/test/ ascdas -import Test_Set/Test01/Test01 -postScript ghidra_detection.py -deleteProject
The Test01 is big binary. If have to change some codes in the ghidra_detection.py, i would again have to run the same command which would require the same analysis to run again requiring more time.
My inquiry was to know if there is any possible way to save the analyzed state and then run the script to that state.

[ryanmkurtz]

One thing you could try is to -import them and let analysis run, but don't pass in your post script. Then, on future runs, do a -process instead of -import and pass in your postscript. If you don't want these changes saved, you can also pass in -readOnly...this will allow you to evaluate your script output without altering the originally analyzed program.

[anzosasuke]

Thanks so much. But i am doing these things and i got these result. Seems like some analysis is done again.
followed two steps:
analyzeHeadless /home/Downloads/main/ test14 import binary
analyzeHeadless /home/Downloads/main/ test14 -process -postScript test.py -readOnly

I got 215 secs for the first one and the next one with the script 118 secs for the analyses excluding the time taken by script. It is faster but 'Decompiler switch analysis' still takes around the same time which is about 80secs. Is this what is possible at the moment?

[ryanmkurtz]

What if you add -noanalysis to your process command?

[anzosasuke]

Even if it takes a bit of a time, i think this is what i need at the moment. Thank you so much for your help.