Ghidra, NSA's reverse-engineering tool
41–50 of 425 posts
Re: Ghidra, NSA's reverse-engineering tool
#42Earlier quoted context omitted.
Not at all,this helps analyze malware not create it. There is no security obtained by preventing reverse engineering of a binary. If anything this makes adversaries ability to hide their methodoligies harder,a strategic advantage for someone like the US government.
I am not sure I completely agree. If I know how my adversary detects and studies stealth code, I may be able to design better stealth code that is better at evading their methods of detection. I mean the evolution of stealth tech in military has followed a similar path. As radar systems improve over decades, they keep on working on new ways to evade detection for aviation/missile tech. I understand the high level poi…
It's just another disassembler. There are a bunch of them already. It is, to the state of the art of reverse engineering, about as big a deal as the first release of Sublime Text was for programmers. It's hard to think of a "downside", or at least one that wouldn't be equivalent to "Sublime Text made it easier for people to code malware".
Re: Ghidra, NSA's reverse-engineering tool
#43Earlier quoted context omitted.
Download from the NSA without open source software... anyone else virtualizing three layers deep to get to this?
AFAICT all the source is there, beside every `.jar` there is a `.zip` with the corresponding source. The source in a more usable form should be posted here soon: https://github.com/NationalSecurityAgency/ghidra/ (And if not I'm sure the community will reconstitute it)
One person’s jar is another’s zip.
Re: Ghidra, NSA's reverse-engineering tool
#44Does it work for non windows binaries?
>includes a suite of software analysis tools for analyzing compiled code on a variety of platforms including Windows, Mac OS, and Linux
From the site, so yes it works on non-windows binaries. It also runs on Linux, Mac and Windows. This is the list of file formats I found in the docs that are supported by Ghidra
* Common Object File Format (COFF)
* Debug Symbols (DBG)
* Executable and Linking Format (ELF)
* Ghidra Data Type Archive Format
* GZF Input Format
* Intel Hex
* Mac OS X Mach-O
* Module Definition (DEF)
* Motorola Hex
* New Executable (NE)
* Old-style DOS Executable (MZ)
* Portable Executable (PE)
* Preferred Executable Format (PEF)
* Program Mapfile (MAP)
* Raw Binary
* XML Input Format
Re: Ghidra, NSA's reverse-engineering tool
#45It's not the first real competitor available to the public. Hopper Disassembler and Binary Ninja are both capable. They have been available for a few years.
Binary Ninja is also collaborative if you get the enterprise edition: https://binary.ninja/purchase/
Re: Ghidra, NSA's reverse-engineering tool
#46Earlier quoted context omitted.
Yup, well aware of them (I think Hopper uses Capstone, FWIW). I'm sure you agree that they're not quite at the level of IDA, though ;)
I'm not especially a fan of IDA, but I don't do much of this work anymore and haven't had a reason to catch up. IDA definitely wouldn't be the first tool I'd reach for in 2019.
I'm not really a fan either, but it's somewhat better and this makes people seem to like to pass around IDBs…
Re: Ghidra, NSA's reverse-engineering tool
#47Earlier quoted context omitted.
I'm not especially a fan of IDA, but I don't do much of this work anymore and haven't had a reason to catch up. IDA definitely wouldn't be the first tool I'd reach for in 2019.
I'm not really a fan either, but it's somewhat better and this makes people seem to like to pass around IDBs…
It's the de facto standard and the program you can assume everyone is already using, plus the fact that a lot of tooling relies on IDA (in part because, for a long time, it was the only game in town) for analysis and function recovery. I don't know if that really makes it "better".
I got out of this stuff before decompilation became a mainstream feature, so it might be a big deal that Ghidra has a strong decompiler.
Re: Ghidra, NSA's reverse-engineering tool
#48Holy shit.
Re: Ghidra, NSA's reverse-engineering tool
#49It's not the first real competitor available to the public. Hopper Disassembler and Binary Ninja are both capable. They have been available for a few years. Binary Ninja is also collaborative if you get the enterprise edition: https://binary.ninja/purchase/
They're arguably competitors if you don't care about decompilation. But Binary Ninja has no decompiler and Hopper's was awful last I checked. Ghidra's decompiler seems as competent as Hex-Rays.
Re: Ghidra, NSA's reverse-engineering tool
#50Earlier quoted context omitted.
Download from the NSA without open source software... anyone else virtualizing three layers deep to get to this?
I don't think they would burn some 0-days for this, one container should be enough.
I think you're underestimating the value of intel on people who know how to get intel or at least interested in the topic.