Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

121–130 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#121

Post by acdha »

TheSoftwareGuy wrote: post #118
tptacek wrote: post #57

Earlier quoted context omitted.

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

All software should be free, The marginal cost of one more user is exactly zero

The people who make software need to be paid. Where do you think that’s coming from – ads?

Re: Ghidra, NSA's reverse-engineering tool

#122

Post by supermw »

emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

IDA Pro is not expensive at all for serious professionals in the field. Other common software in the industry costs way more. Nessus is $2k a year, Metasploit like $1500 to $15000, and Core Impact is $30k and up.

If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around.

Re: Ghidra, NSA's reverse-engineering tool

#123

Post by XMPPwocky »

duskwuff wrote: post #119
XMPPwocky wrote: post #103

Earlier quoted context omitted.

Oh, and I forgot to mention- despite being multi-threaded, it's slooow on massive (50MB+) binaries. Bother your co-workers! Play Pokemon GO outside! Make lunch! Take a nap! Use the foosball table in the 'game room' that's there because we want to seem trendy! When you're done, perhaps the initial analysis will have finished. If you're on the dev branch of binja (which, at least until recently, was miles ahead of stab…

Can you please edit your post to make the word "slooo[…]oow" shorter? It's currently breaking the page layout. :(

Oops.

Re: Ghidra, NSA's reverse-engineering tool

#125

Post by zelon88 »

I'm curious what feature specifically prompted the NSA to develop their own IDA Pro alternative. I mean, someone somewhere at the NSA must have been trying to do something with IDA Pro only to repeatedly fail before the decision was made that whatever the NSA was trying to do warranted developing their own IDA Pro... right? Or perhaps they used IDA Pro so often and grew so frustrated by it that they started their own?

Re: Ghidra, NSA's reverse-engineering tool

#126

Post by mox1 »

zelon88 wrote: post #125

I'm curious what feature specifically prompted the NSA to develop their own IDA Pro alternative. I mean, someone somewhere at the NSA must have been trying to do something with IDA Pro only to repeatedly fail before the decision was made that whatever the NSA was trying to do warranted developing their own IDA Pro... right? Or perhaps they used IDA Pro so often and grew so frustrated by it that they started their own…

Is it possible that maybe this pre-dates IDA Pro?

Ever tried to use IDA Pro on the same project with a co-worker...at the same time?

Re: Ghidra, NSA's reverse-engineering tool

#127

Post by vageli »

supermw wrote: post #122
emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

IDA Pro is not expensive at all for serious professionals in the field. Other common software in the industry costs way more. Nessus is $2k a year, Metasploit like $1500 to $15000, and Core Impact is $30k and up. If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around.

> If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around.

That's an odd perspective. Imagine if this type of sentiment were applied to paint brushes. There is a lot of useful work that is not economically viable per se, and to discount that and to be pejorative feels wrong.

Re: Ghidra, NSA's reverse-engineering tool

#128

Post by tptacek »

yifanlu wrote: post #101
tptacek wrote: post #76

Earlier quoted context omitted.

Leaving the decompiler aside, for core disassembly features, in what ways is modern IDA far ahead of its competitors?

Auto analysis when you have barely any information. Any tool can make nice output if you feed it nice input. Try a partial dump from an exotic device and then you’ll see IDA shine.

See, that's really most of what I ever did with IDA (I don't do a lot of Windows reversing) and I always had to do a lot of binutils munging to get weird architectures to work. But things may have improved dramatically in the last 8 years or so.

Re: Ghidra, NSA's reverse-engineering tool

#129

Post by rotred »

yifanlu wrote: post #99
snazz wrote: post #77

Earlier quoted context omitted.

I’m a casual bystander who has only played with these tools, but I’ve been interested in this field for a long time. Do you think that radare2’s UI is a step forward? I like the Unix-esque command line and how composable everything feels. IDA (and now Ghidra) feel like an IDE, while radare2 feels more like Vim.

I mean having a good UI is great but without the features to back it up, you can’t do anything serious. I tried cutter again a few months ago and went back to ida after an hour of frustration. When handed a binary dump with no executable format or symbols, cutter just chokes while IDA was able to quickly find 90% of functions in memory as well as data xrefs and strings and so on. I’m sure everything performs well on…

do you mind talking a bit about how you got into the field?

Re: Ghidra, NSA's reverse-engineering tool

#130

Post by tptacek »

rubyfan wrote: post #98
tptacek wrote: post #57

Earlier quoted context omitted.

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

In what fields is this type of tooling used routinely?

Malware analysis and vulnerability research.
Post reply on HN