Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

261–270 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#261

Earlier quoted context omitted.

Why? If your real world adversaries can reverse binaries, why would you shackle a Red team from doing so?

Because they have access to the source code itself. No need to reverse engineer anything.

Couldn't compilation introduce vulnerabilities that wouldn't be in the source, but could be found by decompilation?

Re: Ghidra, NSA's reverse-engineering tool

#262
post #78
post #56

I'm definitely excited for this, considering I couldn't fork out the thousand of dollars needed for using IDA. I can't really justify that on a small hobby project (reverse engineering games).

If it’s a hobby project why don’t you just pirate it? Honest question.

Uh, no. So if you are making a small plane hobby project, it is okay to steal from the department store nearby.

A hobby project is for your enjoyment. Pay for your shit. Simple.

I can understand a 14-year-old teenager doing that after his parents refused to purchase the game.

Re: Ghidra, NSA's reverse-engineering tool

#263

I'm curious what feature specifically prompted the NSA to develop their own IDA Pro alternative. I mean, someone somewhere at the NSA must have been trying to do something with IDA Pro only to repeatedly fail before the decision was made that whatever the NSA was trying to do warranted developing their own IDA Pro... right? Or perhaps they used IDA Pro so often and grew so frustrated by it that they started their own…

A few reasons I can think of: 1. Collaborative. 2. supporting classified proprietary architectures (think missile chips or something) 3. The intermediate representation (architecture independent representation of code) can be integrated in to many other classified tools. Maybe for automated analysis for example.

Operational reasons? They found a compromisable worker was employed there, or they somehow put modifications in IDA making the software compromisable and so not safe for them?

Re: Ghidra, NSA's reverse-engineering tool

#264

Earlier quoted context omitted.

A few reasons I can think of: 1. Collaborative. 2. supporting classified proprietary architectures (think missile chips or something) 3. The intermediate representation (architecture independent representation of code) can be integrated in to many other classified tools. Maybe for automated analysis for example.

4. Managing licenses is a huge PITA, presumably especially in environments with lots of classified information.

Good point... "we need a site license. No, I can't tell you for how many employees, that's classified. No, I can't tell you who we are, that's classified. No, I can't tell you what we are working on, that's classified. Hello? Hello? Darn they hung up again..."

Re: Ghidra, NSA's reverse-engineering tool

#265
post #186
post #131

Why do they have a LICENCE file with the Apache Licence in it? As a work of the federal government this is public domain by definition, isn't it? edit: Oh, outside contributors of course retain their own copyright. That's what's licenced. https://github.com/NationalSecurityAgency/ghidra/blob/master...

They can also enforce copyright in other countries.

Can they? How's that work, surely a resident in USA could take the work to the other country and make it available, if they can't then it wasn't public domain in the first place?

Can you point me to any caselaw/ analysis please?

Re: Ghidra, NSA's reverse-engineering tool

#266

Earlier quoted context omitted.

For the lazy: > Restrictions. Subject to applicable copyright, trade secret and other laws, you are permitted under this License to reverse engineer or de-compile the Software but you may not alter, duplicate, modify, rent, lease, loan, sublicense, create derivative works from or provide others with the Software in whole or part, or transmit or communicate any of the Software over a network in order to share it with…

> create derivative works from That's pretty much the only reason one would reverse engineer it, in this context - and it's somewhat misleading to suggest otherwise.

Hunting for bugs to report would be a valid, wouldn't it?

Re: Ghidra, NSA's reverse-engineering tool

#269
post #250

Earlier quoted context omitted.

Even if it is open source, I might worry about using an open source tool from the NSA.

Yeah, my mouse was hovering over the download button eager to test it out when my brain suddenly went "wait, don't do that!" If you wanna run this thing, you should probably build it from source yourself (don't trust the binaries) and even then run it in a pretty well sandboxed virtual machine. I would not be surprised at all if the NSA left some surprises in that thing.

I hope you don't use Linux, because the NSA contributes to quite a lot of OSS. They also created SELinux for instance.

Re: Ghidra, NSA's reverse-engineering tool

#270

Earlier quoted context omitted.

It is available here: https://ghidra-sre.org/

maybe the NSA don't like non-US citizens using open-sourced software :) this is what I get - 403 ERROR The request could not be satisfied. Request blocked. Generated by cloudfront (CloudFront) Request ID: i_Sa-b1Fj2C4ZAUtBsmAp-7mVg9LerDTlD9t1_00ex4fQyCUhrYvdw==

I have the downloaded files if you want to reach me at my email address in my profile, I can upload them to mega or something
Post reply on HN