>clicking the link before reading the domain
regret
Ghidra, NSA's reverse-engineering tool
111–120 of 425 posts
Re: Ghidra, NSA's reverse-engineering tool
#112I am going to sound pessimistic here, but isn't there a real danger of having this technology available to bad actors and is there any value to keeping such things confidential if it plays a role in national security? If someone was releasing malicious software to hijack the power grid as an example, wouldn't they be first able to use this to try to improve the robustness and invisibility of their attack ? Or is the…
Code is so vulnerable right now that only a small number of projects/products get high payments from companies wanting to buy exploits. If this affects the situation, it will be marginal with an increase in vulnerabilities whose number is a drop in the bucket compared to what's already being introduced with poor QA and found by bug hunters. Here's just one project as an example:
https://events.linuxfoundation.org/wp-content/uploads/2017/1...
Re: Ghidra, NSA's reverse-engineering tool
#113[deleted]
Re: Ghidra, NSA's reverse-engineering tool
#114Earlier quoted context omitted.
If it’s a hobby project why don’t you just pirate it? Honest question.
My personal reason for not pirating IDA Pro is because I don't want to contribute to the problem. It's one thing to argue about the effects of piracy on things like video games, where the unit price is much cheaper, and a large number of users are casual users who mostly are going to buy legitimate copies if it's convenient and not exorbitantly expensive. Power user software, like Photoshop, IDA Pro, VMWare, etc. are…
So if you are not paying to IDA's authors either way, what is the difference?
I'd say, by learning to use IDA through a pirated version you create a possibility that one day you will use it for something more serious and you or your employers will pay for it.
One possible argument against that is that by learning how to use all IDA features through a pirated version, you erase the competitive advantage of people who can afford to pay right from the start and remove their incentive to pay.
To that I'd say you would be just levelling the playing field :)
Re: Ghidra, NSA's reverse-engineering tool
#115I wonder how this compares to retdec, an open source cross-architecture decompiler by Avast. https://github.com/avast-tl/retdec
I'm wondering this too. I haven't heard of retdec being used too much, but it looks very cool. I'll guess that Hex-Rays is better, but I still am interested in the opinion of someone more experienced who has tried retdec.
Re: Ghidra, NSA's reverse-engineering tool
#116Earlier quoted context omitted.
I am not sure I completely agree. If I know how my adversary detects and studies stealth code, I may be able to design better stealth code that is better at evading their methods of detection. I mean the evolution of stealth tech in military has followed a similar path. As radar systems improve over decades, they keep on working on new ways to evade detection for aviation/missile tech. I understand the high level poi…
It's just another disassembler. There are a bunch of them already. It is, to the state of the art of reverse engineering, about as big a deal as the first release of Sublime Text was for programmers. It's hard to think of a "downside", or at least one that wouldn't be equivalent to "Sublime Text made it easier for people to code malware".
Should there be export restrictions on weapons grade text editors?
Re: Ghidra, NSA's reverse-engineering tool
#117Earlier quoted context omitted.
Though the obvious explanation for that is that it was an intentional backdoor, that honestly looks more to me like a legitimate oversight than a backdoor. I think an actual backdoor would be a lot more subtle and clever than that. Especially since this way, absolutely anyone could exploit it (it's just Java Debug Wire Protocol). Also, you have to explicitly run it in debug mode for this to happen, which probably onl…
I also don't think it's a backdoor, but the best way to hide a backdoor is to make it look like a mistake.
Then again, maybe the best way to hide a backdoor is to have another very obvious one so people look the other way.
Re: Ghidra, NSA's reverse-engineering tool
#118Earlier quoted context omitted.
For which they charge a per-CPU fortune https://www.hex-rays.com/cgi-bin/quote.cgi
It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…
All software should be free, The marginal cost of one more user is exactly zero
Re: Ghidra, NSA's reverse-engineering tool
#119Earlier quoted context omitted.
Binja could get a decent "C-like" view on top of MLIL, sure, but it still fails in a large number of relatively rare cases. Anybody use SEH or MSVCRT exceptions on x86? Well, there are non-inlined functions that adjust the stack pointer dynamically there. Binary Ninja can't capture that. To be fair, it's unlikely IDA can either- but IDA has a heuristic (read- hack) that treats those functions specially. Result? SP-an…
Oh, and I forgot to mention- despite being multi-threaded, it's slooow on massive (50MB+) binaries. Bother your co-workers! Play Pokemon GO outside! Make lunch! Take a nap! Use the foosball table in the 'game room' that's there because we want to seem trendy! When you're done, perhaps the initial analysis will have finished. If you're on the dev branch of binja (which, at least until recently, was miles ahead of stab…
Can you please edit your post to make the word "slooo[…]oow" shorter? It's currently breaking the page layout. :(
Re: Ghidra, NSA's reverse-engineering tool
#120Also found this community edition linked on twitter: https://ghidrace.github.io/
There's literally nothing there. The project doesn't even exist yet.