Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

201–210 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#201

Post by elliotec »

legitbs_ctf wrote: post #187
justinjlynn wrote: post #163

Earlier quoted context omitted.

No, you almost certainly promised not to do so when you bought a licence.

That’s actually untrue - they explicitly give permission to reverse engineer their software in the license. Check restrictions in https://docs.binary.ninja/about/license/index.html

For the lazy:

> Restrictions. Subject to applicable copyright, trade secret and other laws, you are permitted under this License to reverse engineer or de-compile the Software but you may not alter, duplicate, modify, rent, lease, loan, sublicense, create derivative works from or provide others with the Software in whole or part, or transmit or communicate any of the Software over a network in order to share it with others.

Re: Ghidra, NSA's reverse-engineering tool

#202

Post by Godel_unicode »

in_hindsight wrote: post #169
yifanlu wrote: post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

Out of curiosity what kind of job involves doing binary reverse engineering full time?

Malware analyst, vulnerability research

Re: Ghidra, NSA's reverse-engineering tool

#203

Post by subjectsigma »

I just don't understand the doubt and hate. It's perfectly reasonable to distrust the NSA in most cases, but look at the context - the NSA has a huge brain drain and PR problem. They desperately need qualified people to start trusting and applying to them again. Does anyone seriously think they would try to backdoor security researchers in such a stupidly obvious way?

I was actually at the RSA talk where they released the tool - the presenter was very open in saying that this is a recruiting tool. They want college kids just getting into RE to learn their tools and have their name in the back of their mind so they apply for internships and jobs, and are trained for those roles from day zero. There are other benefits to releasing the tool, like free labor and testing from people submitting patches and bug reports, but the real value is in making the NSA appear like the good guys and getting people on their side.

It seems pretty obvious to me that this gives the NSA more benefit than trying (and probably failing) to hack random people. And yet the dude sitting next to me was shaking his head and saying he would only ever run it in a VM. Irrational as hell.

Re: Ghidra, NSA's reverse-engineering tool

#204

Post by ringaroll »

TheSoftwareGuy wrote: post #118
tptacek wrote: post #57

Earlier quoted context omitted.

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

All software should be free, The marginal cost of one more user is exactly zero

Okay, they you be the first user and pay the R&D costs + the salaries + bug fixing future expenses. I hope you got a billion in your pocket.

Re: Ghidra, NSA's reverse-engineering tool

#205

Post by FBISurveillance »

in_hindsight wrote: post #169
yifanlu wrote: post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

Out of curiosity what kind of job involves doing binary reverse engineering full time?

A job at NSA, for instance.

Re: Ghidra, NSA's reverse-engineering tool

#206

Post by kfriede »

dman wrote: post #199
justinjlynn wrote: post #132

Earlier quoted context omitted.

It's not Open Source.

If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).

Redis. Sidekiq.

Re: Ghidra, NSA's reverse-engineering tool

#207

Post by DC-3 »

dman wrote: post #199
justinjlynn wrote: post #132

Earlier quoted context omitted.

It's not Open Source.

If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).

KDE has full time developers.

Re: Ghidra, NSA's reverse-engineering tool

#208

Post by smokeyj »

tptacek wrote: post #137
zelon88 wrote: post #125

I'm curious what feature specifically prompted the NSA to develop their own IDA Pro alternative. I mean, someone somewhere at the NSA must have been trying to do something with IDA Pro only to repeatedly fail before the decision was made that whatever the NSA was trying to do warranted developing their own IDA Pro... right? Or perhaps they used IDA Pro so often and grew so frustrated by it that they started their own…

Hex-Rays can be hard to deal with, and the IC deals pretty extensively with large federal contractors like Raytheon, so it's possible they just needed something as capable as IDA that they could roll out across all their suppliers to use as a common toolchain and interchange format. But it's also possible this is just sort of a labor of love type thing.

Alternative take. Want to secure national infrastructure? Release the tools to do it for free.

Viva la open-source revolution

Re: Ghidra, NSA's reverse-engineering tool

#210

Post by rapind »

supermw wrote: post #122
emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

IDA Pro is not expensive at all for serious professionals in the field. Other common software in the industry costs way more. Nessus is $2k a year, Metasploit like $1500 to $15000, and Core Impact is $30k and up. If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around.

I wonder if there were some mainframe "professionals" with this opinion before the advent of the personal computer.
Post reply on HN