Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

91–100 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#91

Post by XMPPwocky »

souprock wrote: post #58
comex wrote: post #49

Earlier quoted context omitted.

They're arguably competitors if you don't care about decompilation. But Binary Ninja has no decompiler and Hopper's was awful last I checked. Ghidra's decompiler seems as competent as Hex-Rays.

Binary Ninja has most of a decompiler and is expected to get the rest soon. Binary Ninja offers multiple views of the code, each with an API that gives you the same access that the GUI has. The different views vary in how much they are like assembly or C. Only that last step, real C code, is still missing. Those other views are quite good if your goal is to understand things, but less good if you were hoping to throw…

Binja could get a decent "C-like" view on top of MLIL, sure, but it still fails in a large number of relatively rare cases.

Anybody use SEH or MSVCRT exceptions on x86? Well, there are non-inlined functions that adjust the stack pointer dynamically there. Binary Ninja can't capture that. To be fair, it's unlikely IDA can either- but IDA has a heuristic (read- hack) that treats those functions specially. Result? SP-analysis for all callers generally fails, and Binja becomes convinced that arguments are being passed in eax and ebp.

Ah, but you can just patch the LLIL for calls to those functions to adjust the stack. Oh, no, you actually can't patch LLIL that way- it's immutable after the lifter creates it. Now, you can write your own architecture hook, and there you can be your own lifter- you can call the real lifter, see if it emits a LLIL_CALL to a function you recognize, and if so just emit the stack adjustment LLIL instead. Ah, heh, but you can't- you can't call the real lifter, because it doesn't emit LLIL, it adds LLIL to an existing function, and you can't remove that IL later- it's append-only. And you can't recognize functions easily, because the things passed into your GetInstructionLowLevelIL callback don't include a BinaryView pointer- the thing you'd need to find out anything at all about other functions. You can sort of, kind of, hack around this by calling about five other functions... for every CALL instruction in every function in the binary. This is, ah, less than performant.

Ever reversed a Win32 binary that uses the Win32 API a lot? I hope you like defining structs by hand, because OH BOY are you going to be defining a lot of structs to do anything useful. And you also get to define DWORD, LPDWORD, LPVOID, and every other annoying Windows typedef by hand. (You can be clever and use libclang hackery on the Windows SDK and automate some of this. But you'll have to do it yourself.)

Then there's stuff like type propagation only going forwards inside functions- sometimes. The GUI occasionally deciding that all basic blocks should be laid out in one small square, on top of each other. (You have to reanalyze the function to fix this.)

Mind you, I love Binary Ninja- I bought my own dang commercial license, and renewed it! It's getting better, fast... but it's got its warts.

Re: Ghidra, NSA's reverse-engineering tool

#92

Post by tptacek »

kabwj wrote: post #78
mrmuagi wrote: post #56

I'm definitely excited for this, considering I couldn't fork out the thousand of dollars needed for using IDA. I can't really justify that on a small hobby project (reverse engineering games).

If it’s a hobby project why don’t you just pirate it? Honest question.

Somebody sort of casually pirated a copy of IDA Pro back in the mid-2000s (IIRC, he shared his copy on a public server). The IDA people (DataRescue, at the time, but from what I recall the page survived the move to Hex-Rays) found out, banned him from using IDA, and then put a page on their website threatening to rescind IDA licenses from any company that employed him. The IDA team is pretty aggro.

Re: Ghidra, NSA's reverse-engineering tool

#94

Post by WrtCdEvrydy »

meowface wrote: post #64
stargazing wrote: post #41

Aaaaaand: https://twitter.com/hackerfantastic/status/11030878690637045...

Though the obvious explanation for that is that it was an intentional backdoor, that honestly looks more to me like a legitimate oversight than a backdoor. I think an actual backdoor would be a lot more subtle and clever than that. Especially since this way, absolutely anyone could exploit it (it's just Java Debug Wire Protocol). Also, you have to explicitly run it in debug mode for this to happen, which probably onl…

I wonder if they run Ghidra on a remote machine and run it with some sort of command and control center to automate tasks (IE, run regular some basic automated stuff).

This makes the whole release even more interesting, I wonder if we'll get a statement on why they have that debug mode.

Re: Ghidra, NSA's reverse-engineering tool

#95

Post by simcop2387 »

tptacek wrote: post #76
yifanlu wrote: post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

Leaving the decompiler aside, for core disassembly features, in what ways is modern IDA far ahead of its competitors?

Not sure about everything, but last i looked IDA had a lot more support for different architectures and file formats compared to most of the open source stuff (not sure about other proprietary ones).

Re: Ghidra, NSA's reverse-engineering tool

#96

Post by XMPPwocky »

comex wrote: post #84
souprock wrote: post #58

Earlier quoted context omitted.

Binary Ninja has most of a decompiler and is expected to get the rest soon. Binary Ninja offers multiple views of the code, each with an API that gives you the same access that the GUI has. The different views vary in how much they are like assembly or C. Only that last step, real C code, is still missing. Those other views are quite good if your goal is to understand things, but less good if you were hoping to throw…

Ah, I hadn't heard of the IL functionality. From a quick test of the Binary Ninja demo, it looks like an approach that could become a viable competitor to a decompiler in the future, but isn't a good one in its current state. For instance, one of the most useful aspects of a decompiler for me is the ability to recover high-level control flow, which Binary Ninja apparently doesn't support. Instead it gives you an IDA-…

> It also doesn't seem to allow eliding temporary assignments.

Yeah, there's no copy propagation for MLIL yet. I think they're saving that for HLIL, for some reason. It's exactly as obnoxious as you think it is, though. (For example- click on a variable name. Now other uses are highlighted. Ah, but when 80% of the other uses are just the right hand of assignments, which are then used... you get to trace through that fun chain by yourself!)

There's a community plugin to kind of try to fix this, by actually renaming the intermediate variables to match the RHS's name. This works, sometimes, but is written in Python, which means it's single-threaded and slow, and occasionally it will get stuck in a loop, and sometimes it decides that it wants to rename everything to "ecx_1" or something, in which case you become very grateful that undo exists.

Re: Ghidra, NSA's reverse-engineering tool

#97

Post by XMPPwocky »

jchw wrote: post #90
XMPPwocky wrote: post #83

Earlier quoted context omitted.

Video game modders certainly use IDA. IDA's purchase price, though, is, ah, not an issue for them- not because they have lots of funds available, but rather quite the opposite.

To be fair, I don't think HexRays is oblivious to this dynamic, and to that end I think the freeware version they offer makes a lot of sense. Especially if it supports AMD64, which I'm hearing it does nowadays. That's not going to prevent many people from taking the five finger discount I'm sure, since they'd rather have as many of the features as they can, but at least nobody can say HexRays isn't trying.

Yeah, but I think the big issue is the lack of decompiler. If you're new to RE, it's literally night and day between that and "assembly with stack variables renamed and some helpful comments". (Even Binja's MLIL is a huge step up from the annotated assembly IDA provides.)

Re: Ghidra, NSA's reverse-engineering tool

#98

Post by rubyfan »

tptacek wrote: post #57
_wmd wrote: post #37

Earlier quoted context omitted.

For which they charge a per-CPU fortune https://www.hex-rays.com/cgi-bin/quote.cgi

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

In what fields is this type of tooling used routinely?

Re: Ghidra, NSA's reverse-engineering tool

#99

Post by yifanlu »

snazz wrote: post #77
yifanlu wrote: post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

I’m a casual bystander who has only played with these tools, but I’ve been interested in this field for a long time. Do you think that radare2’s UI is a step forward? I like the Unix-esque command line and how composable everything feels. IDA (and now Ghidra) feel like an IDE, while radare2 feels more like Vim.

I mean having a good UI is great but without the features to back it up, you can’t do anything serious. I tried cutter again a few months ago and went back to ida after an hour of frustration. When handed a binary dump with no executable format or symbols, cutter just chokes while IDA was able to quickly find 90% of functions in memory as well as data xrefs and strings and so on.

I’m sure everything performs well on ELFs built with -O0 -g but in most real world usage, Ida is queen.

Since everything is open source, if ghidra is as good as people say it is, I’m sure people will make better guis for it (and tui) in no time.

Re: Ghidra, NSA's reverse-engineering tool

#100

Post by jchw »

kabwj wrote: post #78
mrmuagi wrote: post #56

I'm definitely excited for this, considering I couldn't fork out the thousand of dollars needed for using IDA. I can't really justify that on a small hobby project (reverse engineering games).

If it’s a hobby project why don’t you just pirate it? Honest question.

My personal reason for not pirating IDA Pro is because I don't want to contribute to the problem. It's one thing to argue about the effects of piracy on things like video games, where the unit price is much cheaper, and a large number of users are casual users who mostly are going to buy legitimate copies if it's convenient and not exorbitantly expensive.

Power user software, like Photoshop, IDA Pro, VMWare, etc. are a different story. They provide tremendous value to both companies and individuals and yet I have no doubt an enormous amount of their poweruser userbase simply have never paid for them. As a young adult or child with no practical way to get a license, this is pretty innocuous since frankly it's hard to argue any sale was lost. But there's plenty of cases where large companies and of course hobbyist users end up pirating the tools they use. I believe Windows XP shipped with some audio files that were produced with a pirated version of Sony Soundforge, for example. That's just silly, but.. it happened.

IDA Pro is an excellent piece of software. They provide a freeware version, which is a pretty nice thing to do. And while the licenses are expensive I have no doubt it is worth it to the companies that purchase it, many times over.

Sadly, I can't afford IDA (as I've discussed eerily recently in HN comments, actually) so I've been mostly avoiding it for now, but I do buy other software, including Windows licenses, Adobe Creative Suite, VMWare, etc. If they're useful enough for me to use, then as an adult with decent income, I pay for them.

Post reply on HN