Good to see NSA has got on board that removing the attack surface of US software is a top priority.
Ghidra
11–20 of 60 posts
Re: Ghidra
#12Uhh, what's this about? https://i.imgur.com/e3kNYTH.png
I haven't worked at US government so I am not 100% sure of the details, but this is my understanding:
HTTPS (tls, really) allows clients to present a certificate, just like the server does. This is commonly used, eg, for microservices authenticating to each other in a backend.
It is less commonly used for people to authenticate to servers.
In particular, the "Common Access Card" is the ID badge used by the DoD, various parts of the armed forces, and in particular the NSA (whose website this is). Those access cards have a key and certificate usable for this.
So your keyboard (or laptop) has a smartcard reader in it, and you can insert your ID badge (maybe with a PIN? not sure if usa gov't does that) to log into any website.
Browser UX for this isn't great. Unlike the newer Webauthn specs where javascript (and thus site-specific instructions) can ask you to log in, the browser has to prompt you in a very generic way to present your certificate.
Re: Ghidra
#13an open source competitor to IDA pro is very welcome, never thought it would come from NSA. have they said anything about their motivation to open-source it?
Re: Ghidra
#14My brother is into reverse engineering, he is literally counting the days to the open source release of this. He said there isn't anything quite like it as it can actually stand toe-to-toe with IDA Pro, the commercial software that apparently nothing yet can really beat.
Yup. IDA Pro is the gold standard, and was basically the only choice for a long time. It's also stupidly expensive and priced for defense contractor funny money, with an individual license nearly $3000 [0]. Most freelancers just use a cracked copy or the freeware version. Recently Hopper and BinaryNinja have been rising in use, with much more affordable pricing plans, but they're still second-rate as far as I know. (…
I've always wondered this - there's a real "pay for your useful tools" philosophy on here at least, for things like Sublime Text. Often quoted is the cost per hour of use, etc. which justify the price (which is admittedly low compared to Ida).
Does the same not apply to Ida where you would make the money back fast enough to justify the pricetag? Or is it that there are more hobbyists and less people making actual money from using Ida?
Re: Ghidra
#15My brother is into reverse engineering, he is literally counting the days to the open source release of this. He said there isn't anything quite like it as it can actually stand toe-to-toe with IDA Pro, the commercial software that apparently nothing yet can really beat.
Is IDA so superior to OllyDBG? What are the differences? I was into reversing in 2009/2010, was just a hobbist trying to crack some programs and making bots to some games.
Re: Ghidra
#16I'm still trying to figure out, in this day and age, especially after the Snowden disclosures, why anyone would trust software released by this organization.
you do realize their primary goal is intelligence gathering?
Re: Ghidra
#17Earlier quoted context omitted.
Yup. IDA Pro is the gold standard, and was basically the only choice for a long time. It's also stupidly expensive and priced for defense contractor funny money, with an individual license nearly $3000 [0]. Most freelancers just use a cracked copy or the freeware version. Recently Hopper and BinaryNinja have been rising in use, with much more affordable pricing plans, but they're still second-rate as far as I know. (…
I've always wondered this - there's a real "pay for your useful tools" philosophy on here at least, for things like Sublime Text. Often quoted is the cost per hour of use, etc. which justify the price (which is admittedly low compared to Ida). Does the same not apply to Ida where you would make the money back fast enough to justify the pricetag? Or is it that there are more hobbyists and less people making actual mon…
This is basically how a monopoly works. And the defense industry behaves like a monopoly even if its made up of a bunch of different companies.
Re: Ghidra
#18I'm still trying to figure out, in this day and age, especially after the Snowden disclosures, why anyone would trust software released by this organization. you do realize their primary goal is intelligence gathering?
It's going to be an open source release so depending on your paranoia levels you could just build it yourself.
Re: Ghidra
#19Earlier quoted context omitted.
Yup. IDA Pro is the gold standard, and was basically the only choice for a long time. It's also stupidly expensive and priced for defense contractor funny money, with an individual license nearly $3000 [0]. Most freelancers just use a cracked copy or the freeware version. Recently Hopper and BinaryNinja have been rising in use, with much more affordable pricing plans, but they're still second-rate as far as I know. (…
I've always wondered this - there's a real "pay for your useful tools" philosophy on here at least, for things like Sublime Text. Often quoted is the cost per hour of use, etc. which justify the price (which is admittedly low compared to Ida). Does the same not apply to Ida where you would make the money back fast enough to justify the pricetag? Or is it that there are more hobbyists and less people making actual mon…
Lots of people make serious money with Ida, it's a license to print money similar to knowing Cisco was a few years ago (although even more so I'm hoping).
The problem is barrier to entry. Many RE blogs and free resources start with "open up Ida", which means that in order to learn how to use the tool to make that money, you first have to buy the tool. Yes, there's the community edition, but it always seems to be missing that one feature you really need...
I'm really curious what the prevalence of tools like this is going to do to the salaries for reverse engineers.
Re: Ghidra
#20an open source competitor to IDA pro is very welcome, never thought it would come from NSA. have they said anything about their motivation to open-source it?
Probably to crowd source maintenance like nearly every other closed to open transition. And ghidra has been leaked a few times (they give it out like candy to contractors) so they're not really losing much.