51–60 of 425 posts
Earlier quoted context omitted.
AFAICT all the source is there, beside every `.jar` there is a `.zip` with the corresponding source. The source in a more usable form should be posted here soon: https://github.com/NationalSecurityAgency/ghidra/ (And if not I'm sure the community will reconstitute it)
One person’s jar is another’s zip.
Earlier quoted context omitted.
Not at all,this helps analyze malware not create it. There is no security obtained by preventing reverse engineering of a binary. If anything this makes adversaries ability to hide their methodoligies harder,a strategic advantage for someone like the US government.
I am not sure I completely agree. If I know how my adversary detects and studies stealth code, I may be able to design better stealth code that is better at evading their methods of detection. I mean the evolution of stealth tech in military has followed a similar path. As radar systems improve over decades, they keep on working on new ways to evade detection for aviation/missile tech. I understand the high level poi…
The upsides of people getting it who aren't willing to break the law outweigh the downsides of bad people getting it more easily. Probably. That's the best you can expect with security tools.
Earlier quoted context omitted.
I'm not really a fan either, but it's somewhat better and this makes people seem to like to pass around IDBs…
It's the de facto standard and the program you can assume everyone is already using, plus the fact that a lot of tooling relies on IDA (in part because, for a long time, it was the only game in town) for analysis and function recovery. I don't know if that really makes it "better". I got out of this stuff before decompilation became a mainstream feature, so it might be a big deal that Ghidra has a strong decompiler.
Earlier quoted context omitted.
> Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. To be fair, IDA Pro has a decompiler plugin to do this.
It does, but it costs an extra $1.5k on top of the main software, per architecture.
Earlier quoted context omitted.
> Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. To be fair, IDA Pro has a decompiler plugin to do this.
For which they charge a per-CPU fortune https://www.hex-rays.com/cgi-bin/quote.cgi
IDA has always had a weirdly low price point given the bill rates of people who use it, and it's interesting to see that price being competed all the way down to free.
It's not the first real competitor available to the public. Hopper Disassembler and Binary Ninja are both capable. They have been available for a few years. Binary Ninja is also collaborative if you get the enterprise edition: https://binary.ninja/purchase/
They're arguably competitors if you don't care about decompilation. But Binary Ninja has no decompiler and Hopper's was awful last I checked. Ghidra's decompiler seems as competent as Hex-Rays.
Binary Ninja offers multiple views of the code, each with an API that gives you the same access that the GUI has. The different views vary in how much they are like assembly or C. Only that last step, real C code, is still missing. Those other views are quite good if your goal is to understand things, but less good if you were hoping to throw the results into a C compiler.
> "{$DEBUG_PORT}"
It's not the first real competitor available to the public. Hopper Disassembler and Binary Ninja are both capable. They have been available for a few years. Binary Ninja is also collaborative if you get the enterprise edition: https://binary.ninja/purchase/