Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

241–250 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#241

Post by sam_lowry_ »

tptacek wrote: post #57
_wmd wrote: post #37

Earlier quoted context omitted.

For which they charge a per-CPU fortune https://www.hex-rays.com/cgi-bin/quote.cgi

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

The pricing of Ida Pro is set to limit the size of the support work and to avoid liabilities. Do not know how it works now, but many years ago, as you were buying Ida Pro, they were asking questions and if anything seemed to imply that you want to hide the buyer's identity, they refused to sell.

That is, Hex-Rays do not want to have any business relationship with the proverbial would-be teenage hackers.

Outside of that, Hex-Rays is a small business which has probably around than 1mln eur/year of turnover and they do not want to grow it much more. It was a Basecamp-style business long before DHH made the concept of anti-growth popular.

Re: Ghidra, NSA's reverse-engineering tool

#242

Post by tomhoward »

supermw wrote: post #230
Godel_unicode wrote: post #198

Earlier quoted context omitted.

Google "video game modding ida". Then think about the fact that some people are poor and can't float thousands of dollars long enough to learn and get employed with tools like this.

I don't think about those people, here's why: 1) No one is entitled to a career in cybersecurity or reverse engineering, no matter how poor or sad your origin story is. 2) There are always lucrative opportunities in this world that are out of reach by people who lack some resource. In this case, it's money, but it could easily just have been something like popularity, beauty, connections, location, or even plain old…

Sorry to hear you're finding it tough. Some people find ways of becoming less constrained by their introversion, but no judgment on you for doing what works for you.

It's true that some pre-existing conditions can limit what options people have, but it doesn't apply to everything.

It's important to be discerning about when this effect applies and when it needn't, and work to open more opportunities to more people wherever possible.

Re: Ghidra, NSA's reverse-engineering tool

#244

Post by Tepix »

yalogin wrote: post #193

You are the leader in your segment of the market one day and the undisputed leader. You wake up and the NSA decides to send a free competitor out with better or matching functionality. Tough blow. But good for us.

I'm surprised that noone is yelling "socialism" yet.

Tax paid competition for existing commercial products. Isn't that considered evil/wrong by pure capitalists?

Re: Ghidra, NSA's reverse-engineering tool

#245

Post by Tepix »

strictnein wrote: post #179
whatshisface wrote: post #139

Earlier quoted context omitted.

An RCE vulnerability has already been found.

Despite what @HackerFantastic is going on about, sloppy remote debugging capabilities enabled with a debug flag isn't an RCE.

It enables remote code execution, that's what RCE stands for.

Re: Ghidra, NSA's reverse-engineering tool

#247

Post by dang »

Tepix wrote: post #244
yalogin wrote: post #193

You are the leader in your segment of the market one day and the undisputed leader. You wake up and the NSA decides to send a free competitor out with better or matching functionality. Tough blow. But good for us.

I'm surprised that noone is yelling "socialism" yet. Tax paid competition for existing commercial products. Isn't that considered evil/wrong by pure capitalists?

"Eschew flamebait. Don't introduce flamewar topics unless you have something genuinely new to say. Avoid unrelated controversies and generic tangents."

https://news.ycombinator.com/newsguidelines.html

Re: Ghidra, NSA's reverse-engineering tool

#248

Post by bryanrasmussen »

emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

Even if it is open source, I might worry about using an open source tool from the NSA.

Re: Ghidra, NSA's reverse-engineering tool

#249

Post by usmannk »

tptacek wrote: post #130
rubyfan wrote: post #98

Earlier quoted context omitted.

In what fields is this type of tooling used routinely?

Malware analysis and vulnerability research.

Would you mind answering some questions if you're familiar with the area (edit: hah, just noticed you posted to the OP to this whole thread.); What are some examples of firms that are involved in this work? Is it mostly a collection of smaller shops/individual contractors? After a cursory search, I seem to be seeing a lot of groups/labs comprised of relatively few people. Why are there so many references to high bill rates in these comments, is the pay especially notorious? That's something I haven't heard before.

Re: Ghidra, NSA's reverse-engineering tool

#250

Post by OskarS »

bryanrasmussen wrote: post #248
emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

Even if it is open source, I might worry about using an open source tool from the NSA.

Yeah, my mouse was hovering over the download button eager to test it out when my brain suddenly went "wait, don't do that!"

If you wanna run this thing, you should probably build it from source yourself (don't trust the binaries) and even then run it in a pretty well sandboxed virtual machine. I would not be surprised at all if the NSA left some surprises in that thing.

Post reply on HN