Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

81–90 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#81
post #76
post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

Leaving the decompiler aside, for core disassembly features, in what ways is modern IDA far ahead of its competitors?

To be fair, without undo, Hex-Rays can only move forwards. This explains their advantage.

Re: Ghidra, NSA's reverse-engineering tool

#83
post #57

Earlier quoted context omitted.

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

It depends on what you're doing. I imagine a lot of people use IDA pro for modding video games, which often/usually provides no monetary compensation. Perhaps they would benefit from some type of "free/cheap for noncommercial use" license?

Video game modders certainly use IDA. IDA's purchase price, though, is, ah, not an issue for them- not because they have lots of funds available, but rather quite the opposite.

Re: Ghidra, NSA's reverse-engineering tool

#84
post #49

Earlier quoted context omitted.

They're arguably competitors if you don't care about decompilation. But Binary Ninja has no decompiler and Hopper's was awful last I checked. Ghidra's decompiler seems as competent as Hex-Rays.

Binary Ninja has most of a decompiler and is expected to get the rest soon. Binary Ninja offers multiple views of the code, each with an API that gives you the same access that the GUI has. The different views vary in how much they are like assembly or C. Only that last step, real C code, is still missing. Those other views are quite good if your goal is to understand things, but less good if you were hoping to throw…

Ah, I hadn't heard of the IL functionality. From a quick test of the Binary Ninja demo, it looks like an approach that could become a viable competitor to a decompiler in the future, but isn't a good one in its current state.

For instance, one of the most useful aspects of a decompiler for me is the ability to recover high-level control flow, which Binary Ninja apparently doesn't support. Instead it gives you an IDA-like graph view (but with IL instead of assembly in the graph nodes); but at least in my experience using IDA without a decompiler, even moderately large functions tend to result in a spiderweb of a graph, and recovering the control flow by hand ends up feeling like a pointless brain teaser. (This condition being true short-circuits this set of comparisons, so it must be an ||... but it still ends up doing this other set of comparisons, which you can also get to from... wait, where was I again?)

It also doesn't seem to allow eliding temporary assignments. Here's a short sample from some random function (retyped by hand since I don't see a way to copy and paste):

    int32_t edx = arg4
    int32_t eax = esi
    eax_1, ecx_2 = sub_3c670(eax, edx)
It does do a sort of SSA transformation and assign unique variable names (like eax_1 instaed of eax) to the same register based on the location in the program, so that's nice. But what I really want is

    eax_1, ecx_2 = sub_3c670(esi, arg4)
I may be missing some option to do this manually, but it should be automatic.

Re: Ghidra, NSA's reverse-engineering tool

#86
post #26

Earlier quoted context omitted.

It's a competitor to IDA's monopoly, basically. It might be better in certain aspects.

IDA has a bunch of competitors --- Hopper, Binja, and all the Capstone interfaces.

So, albeit my use case is a little weird I guess, and I generally am using it for embedded systems, but:

Hopper - is Capstone.

BinaryNinja - The extension API isn't well documented last time I checked. Embedded systems sort of requires letting me fill in some of the gaps myself.

Capstone - I got frustrated when the translation script behind it that autogens code from the LLVM definitions wasn't available (as source or otherwise) which meant that I couldn't add to the instruction set in a meaningful way like I needed to.

Radare(2) - Feels like the barely glued together independent projects that it is. Somehow has a more inscrutable interface than IDA.

One of the frontends I tried (can't remember if it was Hopper, Clipper, or something else) for some reason thought PowerPC had branch delay slots, which was totally screwing up the basic block determination.

Re: Ghidra, NSA's reverse-engineering tool

#87
post #60

It's not the first real competitor available to the public. Hopper Disassembler and Binary Ninja are both capable. They have been available for a few years. Binary Ninja is also collaborative if you get the enterprise edition: https://binary.ninja/purchase/

This looks like an excellent free competitor. Been trying to learn; a tedious process without the fancy tools. Even hopper and binary ninja are very expensive (for a student). Radare2 has been a godsend so far and very helpful, but not as user-friendly.

I did some minimal stuff it and I like it. Its slow and has Java UI is as bad on Windows as expected (in part OpenJDK) but I'll reach for it next I have the need. The main thing that I seem to have missed was some sort of scripting like jython which presumably can be added via extensions or just via code if it is actually missing. Its been a while but I'm happy to see some of my tax dollars at work and this stuff being released back to the public for free rather than used against it.

Re: Ghidra, NSA's reverse-engineering tool

#88
post #75

Earlier quoted context omitted.

It depends on what you're doing. I imagine a lot of people use IDA pro for modding video games, which often/usually provides no monetary compensation. Perhaps they would benefit from some type of "free/cheap for noncommercial use" license?

There is a free (much less capable) version of IDA.

Which doesn't provide decompilation.

Re: Ghidra, NSA's reverse-engineering tool

#89
post #72

Are they serious? They are banning Russian IPs with decompiler source code. Hmm, I know ARM and x86 assembly. Of course, I don't know how to download these sources :)

Legal reasons.

As I see it's licensed under Apache 2.0. I don't know about any regional restrictions for this type of license. But it's could be a real reason because of our stupid government.

Re: Ghidra, NSA's reverse-engineering tool

#90

Earlier quoted context omitted.

It depends on what you're doing. I imagine a lot of people use IDA pro for modding video games, which often/usually provides no monetary compensation. Perhaps they would benefit from some type of "free/cheap for noncommercial use" license?

Video game modders certainly use IDA. IDA's purchase price, though, is, ah, not an issue for them- not because they have lots of funds available, but rather quite the opposite.

To be fair, I don't think HexRays is oblivious to this dynamic, and to that end I think the freeware version they offer makes a lot of sense. Especially if it supports AMD64, which I'm hearing it does nowadays.

That's not going to prevent many people from taking the five finger discount I'm sure, since they'd rather have as many of the features as they can, but at least nobody can say HexRays isn't trying.

Post reply on HN