Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

151–160 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#151

Earlier quoted context omitted.

All software should be free, The marginal cost of one more user is exactly zero

> All software should be free, The marginal cost of one more user is exactly zero All bridges should be free, The marginal cost of one more user is effectively zero.

Toll bridges are quite rare. Most bridges are publicly funded via taxes and free to use, just like Ghidra.

Re: Ghidra, NSA's reverse-engineering tool

#152
post #57

Earlier quoted context omitted.

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

All software should be free, The marginal cost of one more user is exactly zero

Along these lines, the first customer should pay the millions of dollars it takes to market and produce the software and then they can do what they want with it.

Re: Ghidra, NSA's reverse-engineering tool

#153
post #134
post #127

Earlier quoted context omitted.

> If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around. That's an odd perspective. Imagine if this type of sentiment were applied to paint brushes. There is a lot of useful work that is not economically viable per se, and to discount that and to be pejorative feels wrong.

It is less odd if you look at it from the perspective of a professional in the field. Being expensive (and a little mean about it) discourages potential competitors from entry. Not necessarily nice , but it makes sense.

/r/gatekeeping

Re: Ghidra, NSA's reverse-engineering tool

#154
post #126

I'm curious what feature specifically prompted the NSA to develop their own IDA Pro alternative. I mean, someone somewhere at the NSA must have been trying to do something with IDA Pro only to repeatedly fail before the decision was made that whatever the NSA was trying to do warranted developing their own IDA Pro... right? Or perhaps they used IDA Pro so often and grew so frustrated by it that they started their own…

Is it possible that maybe this pre-dates IDA Pro? Ever tried to use IDA Pro on the same project with a co-worker...at the same time?

I believe the included decompiler predates the one that goes with IDA Pro, so that could be a motivation. IDA Pro itself is really really old, having once been a 16-bit DOS shareware program, which explains why IDA Pro doesn't use the GUI shortcuts that were standardized much later.

IDA Pro still doesn't support collaboration, although there are very broken hacks that attempt to add it. Binary Ninja supports collaboration if you buy the enterprise edition.

Re: Ghidra, NSA's reverse-engineering tool

#155

Earlier quoted context omitted.

It's part of the NSA's recruiting push. "If you are interested in projects like this ... consider applying" is even mentioned in the README. There's zero chance there's some secret trojan, because the people who are interested in this type of software are the exact people who would be able to find it.

An RCE vulnerability has already been found.

Also know as debug mode.

Re: Ghidra, NSA's reverse-engineering tool

#156

Earlier quoted context omitted.

It's part of the NSA's recruiting push. "If you are interested in projects like this ... consider applying" is even mentioned in the README. There's zero chance there's some secret trojan, because the people who are interested in this type of software are the exact people who would be able to find it.

An RCE vulnerability has already been found.

If you specifically start GHIDRA in a debug mode, then yes there is a backdoor, but you asked for that.

Re: Ghidra, NSA's reverse-engineering tool

#157

Earlier quoted context omitted.

> All software should be free, The marginal cost of one more user is exactly zero All bridges should be free, The marginal cost of one more user is effectively zero.

Toll bridges are quite rare. Most bridges are publicly funded via taxes and free to use, just like Ghidra.

Speak for yourself, I pay a fortune in tolls.

Re: Ghidra, NSA's reverse-engineering tool

#158
post #38

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.

And they didn't take my money, break my key in an update, and ghost me while I was still in the support period. So they've got that going for them.

Re: Ghidra, NSA's reverse-engineering tool

#159
post #100
post #78

Earlier quoted context omitted.

If it’s a hobby project why don’t you just pirate it? Honest question.

My personal reason for not pirating IDA Pro is because I don't want to contribute to the problem. It's one thing to argue about the effects of piracy on things like video games, where the unit price is much cheaper, and a large number of users are casual users who mostly are going to buy legitimate copies if it's convenient and not exorbitantly expensive. Power user software, like Photoshop, IDA Pro, VMWare, etc. are…

> yet I have no doubt an enormous amount of their poweruser userbase simply have never paid for them.

Do keep in mind that many of these companies expect users to pirate their software. Indeed, piracy is ironically part of what has made Adobe such a big player - teenagers pirating software in highschool, and using it up until their first job, make it their go-to tool when they actually do enter a company. Often leaving the company with no choice but Photoshop!

Re: Ghidra, NSA's reverse-engineering tool

#160

Earlier quoted context omitted.

It's part of the NSA's recruiting push. "If you are interested in projects like this ... consider applying" is even mentioned in the README. There's zero chance there's some secret trojan, because the people who are interested in this type of software are the exact people who would be able to find it.

An RCE vulnerability has already been found.

Calling it a rce vuln is a bit of an exaggeration surely.
Post reply on HN