Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

161–170 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#161

Post by xvilka »

aseipp wrote: post #148
yifanlu wrote: post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

Binja is the only real competitor in any remote sense IMO, and while the LLIL/MLIL are nothing compared to Hex-Rays, they do still dramatically improve the speed of the job. Binja is also fairly extensible/pluggable, though it's pretty undocumented... I just don't do it enough in my spare time these days (not in the field anymore) to justify a Hex-Rays license for myself (even if it is permanent...) That said I just…

I agree, they have a big potential. But if you speak about FOSS alternative - there is already radare2[1]+Cutter[2]+radeco[3].

[1] https://github.com/radare/radare2

[2] https://github.com/radareorg/cutter

[3] https://github.com/radareorg/radeco

Re: Ghidra, NSA's reverse-engineering tool

#162

Post by ShorsHammer »

supermw wrote: post #122
emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

IDA Pro is not expensive at all for serious professionals in the field. Other common software in the industry costs way more. Nessus is $2k a year, Metasploit like $1500 to $15000, and Core Impact is $30k and up. If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around.

What's the average wage of a cyber security professional in SE Asia or Africa compared to these tools?

Re: Ghidra, NSA's reverse-engineering tool

#164

Post by pcwalton »

tptacek wrote: post #140
kbenson wrote: post #136

Earlier quoted context omitted.

> It's a funny situation, though: decompilation probably should cost a small fortune. In the past, the same could have been said of compilers and even web server and mail server software. > many [most?] fields where people routinely decompile stuff are very highly compensated. If it's more freely available, and more people have experience with it, then the compensation might go down as the supply of people with this…

Another way to think about it is that if any piece of professional software should cost a lot, a super-specialized piece of software that is hard to duplicate, is a near industry standard, and is used almost exclusively by people with high bill rates should be expensive. But again, my point is: IDA costs a lot less than its place in the market suggests it should. I'm not arguing that a capable free alternative is a b…

> I think there's an industry business case study in what Hex-Rays could have done to keep this from happening, though.

Is the fact that Hex-Rays is Russian one of the reasons why Ghidra exists? (Honest question.) If so, is there anything they could have done differently?

Re: Ghidra, NSA's reverse-engineering tool

#165

Post by gpm »

gpm wrote: post #28
WrtCdEvrydy wrote: post #10

Earlier quoted context omitted.

Download from the NSA without open source software... anyone else virtualizing three layers deep to get to this?

AFAICT all the source is there, beside every `.jar` there is a `.zip` with the corresponding source. The source in a more usable form should be posted here soon: https://github.com/NationalSecurityAgency/ghidra/ (And if not I'm sure the community will reconstitute it)

After further investigation my above comment is not true.

The decompiler for instance is a precompiled binary (elf64 file on linux) wrapper in some java code. The C/C++/? code is not provided.

Re: Ghidra, NSA's reverse-engineering tool

#166

Post by convery »

snazz wrote: post #62
mrmuagi wrote: post #56

I'm definitely excited for this, considering I couldn't fork out the thousand of dollars needed for using IDA. I can't really justify that on a small hobby project (reverse engineering games).

The free version ( https://www.hex-rays.com/products/ida/support/download_freew... ) would likely meet your needs, assuming the games are for x86.

The freeware version supports x64 as well.

Re: Ghidra, NSA's reverse-engineering tool

#167

Post by willstrafach »

gpm wrote: post #25
mparlane wrote: post #13

Earlier quoted context omitted.

Bad actors have been using IDA this entire time. So no, not really.

Bad actors have had access to this tool too... it was leaked previously. This is cool because: - It's legal and free - It's open source

The tool was never leaked previously.

Re: Ghidra, NSA's reverse-engineering tool

#168

Post by gpm »

justinjlynn wrote: post #163
idlewords wrote: post #150

Earlier quoted context omitted.

You can just reverse-engineer it!

No, you almost certainly promised not to do so when you bought a licence.

Ghidra on the other hand you could, since even if they never get around to fully releasing the source (unlikely) they still granted us an apache license on the whole thing :)

I think it's probably pretty unique right now in that it's under an OSS license without all the source available.

Re: Ghidra, NSA's reverse-engineering tool

#169

Post by in_hindsight »

yifanlu wrote: post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

Out of curiosity what kind of job involves doing binary reverse engineering full time?
Post reply on HN