Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

101–110 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#101

Post by yifanlu »

tptacek wrote: post #76
yifanlu wrote: post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

Leaving the decompiler aside, for core disassembly features, in what ways is modern IDA far ahead of its competitors?

Auto analysis when you have barely any information. Any tool can make nice output if you feed it nice input. Try a partial dump from an exotic device and then you’ll see IDA shine.

Re: Ghidra, NSA's reverse-engineering tool

#102

Post by jchw »

tptacek wrote: post #92
kabwj wrote: post #78

Earlier quoted context omitted.

If it’s a hobby project why don’t you just pirate it? Honest question.

Somebody sort of casually pirated a copy of IDA Pro back in the mid-2000s (IIRC, he shared his copy on a public server). The IDA people (DataRescue, at the time, but from what I recall the page survived the move to Hex-Rays) found out, banned him from using IDA, and then put a page on their website threatening to rescind IDA licenses from any company that employed him. The IDA team is pretty aggro.

To be fair, there's definitely a difference between downloading a pirated version of software, and actually leaking copies of software for others to pirate. The DataRescue and now Hex-Rays folks seem particularly sensitive to leaked copies and I imagine leaked copies genuinely do affect their bottom line of sales given the kinds of markets they're in.

Re: Ghidra, NSA's reverse-engineering tool

#103

Post by XMPPwocky »

XMPPwocky wrote: post #91
souprock wrote: post #58

Earlier quoted context omitted.

Binary Ninja has most of a decompiler and is expected to get the rest soon. Binary Ninja offers multiple views of the code, each with an API that gives you the same access that the GUI has. The different views vary in how much they are like assembly or C. Only that last step, real C code, is still missing. Those other views are quite good if your goal is to understand things, but less good if you were hoping to throw…

Binja could get a decent "C-like" view on top of MLIL, sure, but it still fails in a large number of relatively rare cases. Anybody use SEH or MSVCRT exceptions on x86? Well, there are non-inlined functions that adjust the stack pointer dynamically there. Binary Ninja can't capture that. To be fair, it's unlikely IDA can either- but IDA has a heuristic (read- hack) that treats those functions specially. Result? SP-an…

Oh, and I forgot to mention- despite being multi-threaded, it's slooow on massive (50MB+) binaries. Bother your co-workers! Play Pokemon GO outside! Make lunch! Take a nap! Use the foosball table in the 'game room' that's there because we want to seem trendy! When you're done, perhaps the initial analysis will have finished.

If you're on the dev branch of binja (which, at least until recently, was miles ahead of stable), you get to do this again in a few days when binja updates and throws out all its old cached information.

Also, saving and loading massive databases can easily be a 5-minutes-or-more process. Again- this does provide you with ample time to explore the area around your office building, but still.

(Mind, this isn't a problem if you mostly see small binaries- for malware it's probably entirely fine.)

Re: Ghidra, NSA's reverse-engineering tool

#104

Post by jchw »

XMPPwocky wrote: post #97
jchw wrote: post #90

Earlier quoted context omitted.

To be fair, I don't think HexRays is oblivious to this dynamic, and to that end I think the freeware version they offer makes a lot of sense. Especially if it supports AMD64, which I'm hearing it does nowadays. That's not going to prevent many people from taking the five finger discount I'm sure, since they'd rather have as many of the features as they can, but at least nobody can say HexRays isn't trying.

Yeah, but I think the big issue is the lack of decompiler. If you're new to RE, it's literally night and day between that and "assembly with stack variables renamed and some helpful comments". (Even Binja's MLIL is a huge step up from the annotated assembly IDA provides.)

I agree that the decompiler is amazingly useful... but it's pretty telling that there's really no alternatives that come close. I sympathize with hobbyists that pirate IDA Pro, but I personally wish we could do better than that.

Re: Ghidra, NSA's reverse-engineering tool

#105

Post by souprock »

snazz wrote: post #77
yifanlu wrote: post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

I’m a casual bystander who has only played with these tools, but I’ve been interested in this field for a long time. Do you think that radare2’s UI is a step forward? I like the Unix-esque command line and how composable everything feels. IDA (and now Ghidra) feel like an IDE, while radare2 feels more like Vim.

It really is a job for a GUI, but even IDA lets you type commands. You can use Python, or a built-in language that is in the C family, or anything custom that you have attached to the plug-in interface. I would be surprised if one of these tools is lacking such a capability.

Re: Ghidra, NSA's reverse-engineering tool

#106

Post by XMPPwocky »

yifanlu wrote: post #101
tptacek wrote: post #76

Earlier quoted context omitted.

Leaving the decompiler aside, for core disassembly features, in what ways is modern IDA far ahead of its competitors?

Auto analysis when you have barely any information. Any tool can make nice output if you feed it nice input. Try a partial dump from an exotic device and then you’ll see IDA shine.

Definitely- it's all the years of tweaking and the massive numbers of heuristics to handle, i don't know, code emitted by Microsoft Visual FORTRAN from 1972- that's IDA's moat. Screw the decompiler. If GHIDRA can match that, it's a huge step forwards.

Re: Ghidra, NSA's reverse-engineering tool

#108

Post by meowface »

earenndil wrote: post #73
meowface wrote: post #64

Earlier quoted context omitted.

Though the obvious explanation for that is that it was an intentional backdoor, that honestly looks more to me like a legitimate oversight than a backdoor. I think an actual backdoor would be a lot more subtle and clever than that. Especially since this way, absolutely anyone could exploit it (it's just Java Debug Wire Protocol). Also, you have to explicitly run it in debug mode for this to happen, which probably onl…

I also don't think it's a backdoor, but the best way to hide a backdoor is to make it look like a mistake.

>but the best way to hide a backdoor is to make it look like a mistake

It is, but usually the best way to do is to make it look like a mistake that's very subtle and difficult to notice without careful testing and analysis, kind of like Apple's infamous SSL "goto fail". That's a classic example of a vulnerability that really could be either an honest mistake or a very insidious backdoor.

This is more like leaving the house's sliding glass door to the backyard wide open for everyone to see.

Re: Ghidra, NSA's reverse-engineering tool

#110

Post by strictnein »

omeid2 wrote: post #50
aboutruby wrote: post #14

Earlier quoted context omitted.

I don't think they would burn some 0-days for this, one container should be enough.

I think you're underestimating the value of intel on people who know how to get intel or at least interested in the topic.

It's part of the NSA's recruiting push. "If you are interested in projects like this ... consider applying" is even mentioned in the README.

There's zero chance there's some secret trojan, because the people who are interested in this type of software are the exact people who would be able to find it.

Post reply on HN