Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

331–340 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#331

Post by subjectsigma »

stebann wrote: post #286
subjectsigma wrote: post #203

I just don't understand the doubt and hate. It's perfectly reasonable to distrust the NSA in most cases, but look at the context - the NSA has a huge brain drain and PR problem. They desperately need qualified people to start trusting and applying to them again. Does anyone seriously think they would try to backdoor security researchers in such a stupidly obvious way? I was actually at the RSA talk where they release…

Well, they shouln't have involve in "hacking random people". Then we would trust them. They didn't and they still have surveillance and hacking programs. Why would I expose myself and become a target for the next years? Are they trying to know where are the new targets?

Your comment makes no sense whatsoever. Let's say you're an NSA target. You're probably already hacked. If not, then you are very smart or you haven't been an NSA target for long. Let's assume you're a very smart malware researcher - that means you 1. Already have tools like IDA and don't need this, 2. Have an in depth knowledge of how to acquire and run potentially malicious code safely, 3. Have experience figuring out if that code is malicious.

Do you think the winning strategy for the NSA here is to attack you in a way that you're perfectly equipped to deal with?

Re: Ghidra, NSA's reverse-engineering tool

#332

Post by philpem »

jchw wrote: post #102
tptacek wrote: post #92

Earlier quoted context omitted.

Somebody sort of casually pirated a copy of IDA Pro back in the mid-2000s (IIRC, he shared his copy on a public server). The IDA people (DataRescue, at the time, but from what I recall the page survived the move to Hex-Rays) found out, banned him from using IDA, and then put a page on their website threatening to rescind IDA licenses from any company that employed him. The IDA team is pretty aggro.

To be fair, there's definitely a difference between downloading a pirated version of software, and actually leaking copies of software for others to pirate. The DataRescue and now Hex-Rays folks seem particularly sensitive to leaked copies and I imagine leaked copies genuinely do affect their bottom line of sales given the kinds of markets they're in.

They certainly seemed to be very much against selling it to private individuals (or were when I asked many years ago).

I guess unless you've got a CV which says "presented at Defcon and Blackhat, five times" or "currently work at {big infosec company}", even if you can afford it the answer will be "nope".

The end result for me was that I bought a Mac Mini and a copy of Hopper and Synalyze It. My entire reverse-engineering of the Polaroid film recorder driver (and the resulting Linux port) was done by reversing the driver DLL in Hopper and shimming the driver and ASPI calls with PyDbg.

I keep looking away for a month or so and finding a new version of Hopper with shiny new features to play with...

Re: Ghidra, NSA's reverse-engineering tool

#334

Post by EE84M3i »

lsiebert wrote: post #307
justinjlynn wrote: post #132

Earlier quoted context omitted.

It's not Open Source.

It's being released at RSA as open source, so it's more correct to say that it's not open source yet.

This was in reference to Binary Ninja, which was neither released at RSA nor is Open Source.

Re: Ghidra, NSA's reverse-engineering tool

#336

Post by ivg_t »

ernst_klim wrote: post #279
emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

>is basically the first real competitor to IDA Pro What do you think of BAP[1]? [1] https://github.com/BinaryAnalysisPlatform/bap

BAP is not a competitor to IDA Pro or Ghidra, it's a platform for implementing automated analysis, while IDA and Ghidra are more like reverse engineering tools that are focused on human interactions. We do support IDA Pro so that you can run BAP analysis from it and have the best of two words. We will soon roll out the support for Ghidra too (the issue is created [1]).

What is a really great contribution of Ghidra, to my opinion, is the detailed specification of all supported ISA in Sleigh (their terse and concrete ISA specification language). Ghidra ships with about ~200kLOC of instruction descriptions and this is the most valuable contribution to the community. We're planning to support Sleigh in the nearest future, and I believe that Sleigh might become a standard de facto for instruction semantics specification.

[1]: https://github.com/BinaryAnalysisPlatform/bap/issues/929

Re: Ghidra, NSA's reverse-engineering tool

#337

Post by MileyCyrax »

J253 wrote: post #219

Can anyone speculate as to why the NSA decided to release this? Have they released any OSS in the past?

From https://published-prd.lanyonevents.com/published/rsaus19/ses... (page 7):

  >Why Did We Release Ghidra?
  > * Improve cybersecurity tools
  > * Build a community
  > * Educational Use
  > * Your tax dollars at work

Re: Ghidra, NSA's reverse-engineering tool

#339

Post by lambda »

rubyfan wrote: post #98
tptacek wrote: post #57

Earlier quoted context omitted.

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

In what fields is this type of tooling used routinely?

Besides the usual ones, I've had to use IDA Pro occasionally for compatibility purposes in my job as a NAS vendor.

There are lots of apps that make lots of assumptions about how filesystems behave, generally based on the local filesystem and maybe on one popular networked filesystem for the platform (NFS, SMB, AFP).

If one of those assumptions is violated, applications can crash or refuse to interact with you. Some just refuse to write to any networked filesystem. Some run only on whitelisted filesystems. Some will hit an error due to an unsupported operation on your filesystem, fall back to some ancient code path using long-since deprecated Carbon APIs that only work properly on 32 bit systems, and so truncate all of your data to 2 GB.

Problems like the latter are really helped by being able to do some reverse engineering of the application to figure out why the heck it just writes out the first 2 GB of the file.

Because this isn't our bread and butter but only an occasional tool in our toolbox, the licensing on IDA Pro can be rather frustrating. We use it only once every couple of years to debug some kind of compatibility issue like this, and so we usually have to dig around to figure out if we still have valid licenses, deactivate systems that we're no longer using, and so on.

Re: Ghidra, NSA's reverse-engineering tool

#340

Post by jjoonathan »

philpem wrote: post #327
jjoonathan wrote: post #158

Earlier quoted context omitted.

And they didn't take my money, break my key in an update, and ghost me while I was still in the support period. So they've got that going for them.

Did they ever tell you why they did that? I'd like to hear the rest of this story, I was considering buying IDA Pro (though these days I'm having a lot of fun adding M68k support to Avast's Retdec)

No, they never replied at all. Their self-service site broke and they completely and utterly ignored my emails to the associated service address and to a number of other addresses posted on their site.

I grew up using, ah, other methods of satisfying my need for an interactive debugger and those methods continued to be viable after giving hex-rays $1100 and getting flaked, so I wasn't materially impacted by the flakery, even though I "should" have been. Had I been materially impacted rather than merely angered and frustrated, I probably would have tried other escalation paths -- phone, twitter, maybe even snail mail -- and I suspect I eventually could have gotten through, and my expectation absent evidence to the contrary is that if I were to have gotten through they would have helped me out. My takeaway would be "their self-service site is rubbish and they force you to use a company email address (as opposed to your gmail) and then their support email servers sometimes silently drop messages from your company email address, or something," not "they're crooks." On a professional app sold at a professional price, though, that's still not a good thing, and it informed my software choices going forward.

Post reply on HN