Ghidra, NSA's reverse-engineering tool • Hacker News Board

Re: Ghidra, NSA's reverse-engineering tool

#191

Post by merlincorey » Wed, Mar 06, 2019, 5:24 AM UTC

meowface wrote: post #64

stargazing wrote: post #41

Aaaaaand: https://twitter.com/hackerfantastic/status/11030878690637045...

Though the obvious explanation for that is that it was an intentional backdoor, that honestly looks more to me like a legitimate oversight than a backdoor. I think an actual backdoor would be a lot more subtle and clever than that. Especially since this way, absolutely anyone could exploit it (it's just Java Debug Wire Protocol). Also, you have to explicitly run it in debug mode for this to happen, which probably onl…

> Kind of seems like the equivalent of running Flask apps in debug mode, which by default will handle exceptions by showing a traceback with an interactive debugger that can be used to execute arbitrary code.

As an aside, this is no longer precisely the case, though it was for quite some time.

With modern Flask (> 1.0.0), the debug server will start with a randomly generated PIN output to STDOUT when the server starts. In turn this PIN must be entered on the web interface to execute commands.

Re: Ghidra, NSA's reverse-engineering tool

#192

Post by adrianN » Wed, Mar 06, 2019, 5:30 AM UTC

nordsieck wrote: post #144

TheSoftwareGuy wrote: post #118

Earlier quoted context omitted.

All software should be free, The marginal cost of one more user is exactly zero

> All software should be free, The marginal cost of one more user is exactly zero All bridges should be free, The marginal cost of one more user is effectively zero.

If you're suggesting we should fund critical software in the same way that we fund bridges, then I support that motion.

Re: Ghidra, NSA's reverse-engineering tool

#193

Post by yalogin » Wed, Mar 06, 2019, 5:34 AM UTC

You are the leader in your segment of the market one day and the undisputed leader. You wake up and the NSA decides to send a free competitor out with better or matching functionality. Tough blow. But good for us.

Re: Ghidra, NSA's reverse-engineering tool

#194

Post by yalogin » Wed, Mar 06, 2019, 5:37 AM UTC

zelon88 wrote: post #125

I'm curious what feature specifically prompted the NSA to develop their own IDA Pro alternative. I mean, someone somewhere at the NSA must have been trying to do something with IDA Pro only to repeatedly fail before the decision was made that whatever the NSA was trying to do warranted developing their own IDA Pro... right? Or perhaps they used IDA Pro so often and grew so frustrated by it that they started their own…

May be the NSA probably had this before IDA came about. It’s the NSA after all. They are now releasing it because it’s not a competitive edge anymore and can be used as a recruiting tool.

Re: Ghidra, NSA's reverse-engineering tool

#195

Post by [deleted] » Wed, Mar 06, 2019, 5:50 AM UTC

adrianN wrote: post #192

nordsieck wrote: post #144

Earlier quoted context omitted.

> All software should be free, The marginal cost of one more user is exactly zero All bridges should be free, The marginal cost of one more user is effectively zero.

If you're suggesting we should fund critical software in the same way that we fund bridges, then I support that motion.

[deleted]

Re: Ghidra, NSA's reverse-engineering tool

#196

Post by kdbg » Wed, Mar 06, 2019, 5:51 AM UTC

ramon wrote: post #85

does Ghidra work for APK files, it would be cool if it also worked with mobile projects.

Yes it does work with APKs.

Well, it should. It kept having issues with the only APK I had on hand, but when I just pulled some DEX files out and loaded them it handled them just fine (including decompilation)

Re: Ghidra, NSA's reverse-engineering tool

#197

Post by lemonhuman » Wed, Mar 06, 2019, 5:51 AM UTC

nordsieck wrote: post #144

TheSoftwareGuy wrote: post #118

Earlier quoted context omitted.

All software should be free, The marginal cost of one more user is exactly zero

> All software should be free, The marginal cost of one more user is exactly zero All bridges should be free, The marginal cost of one more user is effectively zero.

Bad analogy. Bridges have upkeep.

Re: Ghidra, NSA's reverse-engineering tool

#198

Post by Godel_unicode » Wed, Mar 06, 2019, 5:56 AM UTC

supermw wrote: post #173

vageli wrote: post #127

Earlier quoted context omitted.

> If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around. That's an odd perspective. Imagine if this type of sentiment were applied to paint brushes. There is a lot of useful work that is not economically viable per se, and to discount that and to be pejorative feels wrong.

If you are using these tools you are either defending systems from threats or breaking into systems and making money through illegal activities. There is not really any other useful work you can do with these tools. I don’t see how the perspective is odd. Having tools like Core Impact and the knowledge of how to use them well can propel you to a six figure income easily. On top of that these tools are also business e…

Google "video game modding ida".

Then think about the fact that some people are poor and can't float thousands of dollars long enough to learn and get employed with tools like this.

Re: Ghidra, NSA's reverse-engineering tool

#199

Post by dman » Wed, Mar 06, 2019, 5:57 AM UTC

justinjlynn wrote: post #132

dman wrote: post #38

Earlier quoted context omitted.

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.

It's not Open Source.

If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).

Re: Ghidra, NSA's reverse-engineering tool

#200

Post by yaps8 » Wed, Mar 06, 2019, 5:58 AM UTC

pcwalton wrote: post #164

tptacek wrote: post #140

Earlier quoted context omitted.

Another way to think about it is that if any piece of professional software should cost a lot, a super-specialized piece of software that is hard to duplicate, is a near industry standard, and is used almost exclusively by people with high bill rates should be expensive. But again, my point is: IDA costs a lot less than its place in the market suggests it should. I'm not arguing that a capable free alternative is a b…

> I think there's an industry business case study in what Hex-Rays could have done to keep this from happening, though. Is the fact that Hex-Rays is Russian one of the reasons why Ghidra exists? (Honest question.) If so, is there anything they could have done differently?

Hex-Rays is in Belgium.