Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

141–150 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#141

Post by arthurcolle »

supermw wrote: post #122
emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

IDA Pro is not expensive at all for serious professionals in the field. Other common software in the industry costs way more. Nessus is $2k a year, Metasploit like $1500 to $15000, and Core Impact is $30k and up. If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around.

What advantages does the paid version of Metasploit offer? I have been able to do some pretty incredible stuff with the free offering...

Re: Ghidra, NSA's reverse-engineering tool

#142

Post by DannyBee »

snazz wrote: post #115
alexozer wrote: post #93

I wonder how this compares to retdec, an open source cross-architecture decompiler by Avast. https://github.com/avast-tl/retdec

I'm wondering this too. I haven't heard of retdec being used too much, but it looks very cool. I'll guess that Hex-Rays is better, but I still am interested in the opinion of someone more experienced who has tried retdec.

I'll go one better: I've contributed patches to retdec.

Retdec is ... okay.

On small binaries it's usable. On even average sized windows binaries (a few meg), not really.

Like on things that IDA takes 10-15 minutes and a reasonable amount of memory (like a 7 meg windows binary), retdec can take forever and unlimited amounts of memory.

I started fixing a lot of the memory issues (completely recursive CFG traversal, etc), but there are also very serious algorithmic issues (N^3/N^4 algorithms in the optimizers).

If i disable a lot of the backend optimizers, i can make it work okay.

But then the output is also a lot larger/worse. To be fair: It used to be about 50x bigger than similar IDA output. The latest development version of retdec now has a new backend IR converter, and the output is only 5x-10x bigger than IDA output.

So as a TL;DR: retdec in its default state is unusable for anything but small binaries. If you understand what is going on, you can get it to work on a lot of binaries as long as you have a ton of memory and time to spare.

Re: Ghidra, NSA's reverse-engineering tool

#144

Post by nordsieck »

TheSoftwareGuy wrote: post #118
tptacek wrote: post #57

Earlier quoted context omitted.

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

All software should be free, The marginal cost of one more user is exactly zero

> All software should be free, The marginal cost of one more user is exactly zero

All bridges should be free, The marginal cost of one more user is effectively zero.

Re: Ghidra, NSA's reverse-engineering tool

#147

Post by pcwalton »

tptacek wrote: post #57
_wmd wrote: post #37

Earlier quoted context omitted.

For which they charge a per-CPU fortune https://www.hex-rays.com/cgi-bin/quote.cgi

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

Isn't that true for lots of software that's been driven down to zero cost, though? Like, say, TensorFlow? Given the business value of people who need to use TensorFlow, it "should" cost more than even IDA.

It feels like to stay in business with software like this, it has to be lucrative, but not too lucrative, or else FAANG companies (or occasionally governments, like in this case) will either gobble up or kill the market.

Re: Ghidra, NSA's reverse-engineering tool

#148

Post by aseipp »

yifanlu wrote: post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

Binja is the only real competitor in any remote sense IMO, and while the LLIL/MLIL are nothing compared to Hex-Rays, they do still dramatically improve the speed of the job. Binja is also fairly extensible/pluggable, though it's pretty undocumented... I just don't do it enough in my spare time these days (not in the field anymore) to justify a Hex-Rays license for myself (even if it is permanent...)

That said I just renewed my license so I have to get some use out of it, but Ghidra does seem like it could be the real deal. Honestly, I never really expected any free/FOSS alternative to IDA to ever exist at this point, so the possibility is tantalizing.

Re: Ghidra, NSA's reverse-engineering tool

#149

Post by smokeyj »

tptacek wrote: post #140
kbenson wrote: post #136

Earlier quoted context omitted.

> It's a funny situation, though: decompilation probably should cost a small fortune. In the past, the same could have been said of compilers and even web server and mail server software. > many [most?] fields where people routinely decompile stuff are very highly compensated. If it's more freely available, and more people have experience with it, then the compensation might go down as the supply of people with this…

Another way to think about it is that if any piece of professional software should cost a lot, a super-specialized piece of software that is hard to duplicate, is a near industry standard, and is used almost exclusively by people with high bill rates should be expensive. But again, my point is: IDA costs a lot less than its place in the market suggests it should. I'm not arguing that a capable free alternative is a b…

> But again, my point is: IDA costs a lot less than its place in the market suggests it should.

Sounds like every developer working on an open source stack.

Re: Ghidra, NSA's reverse-engineering tool

#150

Post by idlewords »

justinjlynn wrote: post #132
dman wrote: post #38

Earlier quoted context omitted.

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.

It's not Open Source.

You can just reverse-engineer it!
Post reply on HN