Earlier quoted context omitted.
Why? If your real world adversaries can reverse binaries, why would you shackle a Red team from doing so?
Because they have access to the source code itself. No need to reverse engineer anything.
Ghidra, NSA's reverse-engineering tool
261–270 of 425 posts
Re: Ghidra, NSA's reverse-engineering tool
#262I'm definitely excited for this, considering I couldn't fork out the thousand of dollars needed for using IDA. I can't really justify that on a small hobby project (reverse engineering games).
If it’s a hobby project why don’t you just pirate it? Honest question.
A hobby project is for your enjoyment. Pay for your shit. Simple.
I can understand a 14-year-old teenager doing that after his parents refused to purchase the game.
Re: Ghidra, NSA's reverse-engineering tool
#263I'm curious what feature specifically prompted the NSA to develop their own IDA Pro alternative. I mean, someone somewhere at the NSA must have been trying to do something with IDA Pro only to repeatedly fail before the decision was made that whatever the NSA was trying to do warranted developing their own IDA Pro... right? Or perhaps they used IDA Pro so often and grew so frustrated by it that they started their own…
A few reasons I can think of: 1. Collaborative. 2. supporting classified proprietary architectures (think missile chips or something) 3. The intermediate representation (architecture independent representation of code) can be integrated in to many other classified tools. Maybe for automated analysis for example.
Re: Ghidra, NSA's reverse-engineering tool
#264Earlier quoted context omitted.
A few reasons I can think of: 1. Collaborative. 2. supporting classified proprietary architectures (think missile chips or something) 3. The intermediate representation (architecture independent representation of code) can be integrated in to many other classified tools. Maybe for automated analysis for example.
4. Managing licenses is a huge PITA, presumably especially in environments with lots of classified information.
Re: Ghidra, NSA's reverse-engineering tool
#265Why do they have a LICENCE file with the Apache Licence in it? As a work of the federal government this is public domain by definition, isn't it? edit: Oh, outside contributors of course retain their own copyright. That's what's licenced. https://github.com/NationalSecurityAgency/ghidra/blob/master...
They can also enforce copyright in other countries.
Can you point me to any caselaw/ analysis please?
Re: Ghidra, NSA's reverse-engineering tool
#266Earlier quoted context omitted.
For the lazy: > Restrictions. Subject to applicable copyright, trade secret and other laws, you are permitted under this License to reverse engineer or de-compile the Software but you may not alter, duplicate, modify, rent, lease, loan, sublicense, create derivative works from or provide others with the Software in whole or part, or transmit or communicate any of the Software over a network in order to share it with…
> create derivative works from That's pretty much the only reason one would reverse engineer it, in this context - and it's somewhat misleading to suggest otherwise.
Re: Ghidra, NSA's reverse-engineering tool
#267Ghid = Vulture
Ra = In Sanskrit RA is the acoustic root of fire. RA also connotes with light or spiritual light.
Re: Ghidra, NSA's reverse-engineering tool
#268Re: Ghidra, NSA's reverse-engineering tool
#269Earlier quoted context omitted.
Even if it is open source, I might worry about using an open source tool from the NSA.
Yeah, my mouse was hovering over the download button eager to test it out when my brain suddenly went "wait, don't do that!" If you wanna run this thing, you should probably build it from source yourself (don't trust the binaries) and even then run it in a pretty well sandboxed virtual machine. I would not be surprised at all if the NSA left some surprises in that thing.
Re: Ghidra, NSA's reverse-engineering tool
#270Earlier quoted context omitted.
It is available here: https://ghidra-sre.org/
maybe the NSA don't like non-US citizens using open-sourced software :) this is what I get - 403 ERROR The request could not be satisfied. Request blocked. Generated by cloudfront (CloudFront) Request ID: i_Sa-b1Fj2C4ZAUtBsmAp-7mVg9LerDTlD9t1_00ex4fQyCUhrYvdw==