Aaaaaand: https://twitter.com/hackerfantastic/status/11030878690637045...
An overhyped tweet. You have to enable debug mode on it. It's not something that runs by default.
Yes this doesn't really seem like a big deal
Ghidra, NSA's reverse-engineering tool
341–350 of 425 posts
Re: Ghidra, NSA's reverse-engineering tool
#342So, I've tried it on some mips binaries I've been reverse engineering on and off last 7 years from assembly, for various reasons. I'm completely blown away by the quality of the decompiler output. The binaries include symbols, so everything global is named correctly, which helps. Anyway, nothing I've tried over the years comes even close to the clean output I'm seeing from Ghidra.
It's great.
Re: Ghidra, NSA's reverse-engineering tool
#343Earlier quoted context omitted.
To be fair, there's definitely a difference between downloading a pirated version of software, and actually leaking copies of software for others to pirate. The DataRescue and now Hex-Rays folks seem particularly sensitive to leaked copies and I imagine leaked copies genuinely do affect their bottom line of sales given the kinds of markets they're in.
They certainly seemed to be very much against selling it to private individuals (or were when I asked many years ago). I guess unless you've got a CV which says "presented at Defcon and Blackhat, five times" or "currently work at {big infosec company}", even if you can afford it the answer will be "nope". The end result for me was that I bought a Mac Mini and a copy of Hopper and Synalyze It. My entire reverse-engine…
I really really liked hopper.
it's probably the one app I missed most switching to windows.
x64dbg eventually grew on me and I like it nearly as much.
Re: Ghidra, NSA's reverse-engineering tool
#344Earlier quoted context omitted.
My personal reason for not pirating IDA Pro is because I don't want to contribute to the problem. It's one thing to argue about the effects of piracy on things like video games, where the unit price is much cheaper, and a large number of users are casual users who mostly are going to buy legitimate copies if it's convenient and not exorbitantly expensive. Power user software, like Photoshop, IDA Pro, VMWare, etc. are…
> yet I have no doubt an enormous amount of their poweruser userbase simply have never paid for them. Do keep in mind that many of these companies expect users to pirate their software. Indeed, piracy is ironically part of what has made Adobe such a big player - teenagers pirating software in highschool, and using it up until their first job, make it their go-to tool when they actually do enter a company. Often leavi…
A scathing critique of software pirating.
Re: Ghidra, NSA's reverse-engineering tool
#345I wonder how this compares to retdec, an open source cross-architecture decompiler by Avast. https://github.com/avast-tl/retdec
Retdec is based in part on Capstone, like Hopper.
I believe Capstone is merely a disassembly framework, and retdec's decompilation process is custom implementation which works on LLVM IR.
Re: Ghidra, NSA's reverse-engineering tool
#346Re: Ghidra, NSA's reverse-engineering tool
#347Can anyone speculate as to why the NSA decided to release this? Have they released any OSS in the past?
I suspect they're just trying to expand US cyber capabilities and recruiting.
“If I go to the next capture-the-flag contest and I see some college students using Ghidra, I will be really excited” - Rob Joyce, senior cybersecurity adviser at NSA
Re: Ghidra, NSA's reverse-engineering tool
#348Earlier quoted context omitted.
Despite what @HackerFantastic is going on about, sloppy remote debugging capabilities enabled with a debug flag isn't an RCE.
It enables remote code execution, that's what RCE stands for.
The issue is with "vulnerability". By that loose definition, every modern IDE has an RCE "vulnerability".
Re: Ghidra, NSA's reverse-engineering tool
#349Earlier quoted context omitted.
Being open-sourced is a big advantage. I just fixed a bug in GHIDRA relating to trackpad scrolling which makes it MUCH more usable for me. I could never do the same with IDA or Binary Ninja. I do so love the shell code compiler of Binary Ninja, though. It works very well and has definitely saved me a lot of time.
Awesome! Please don't forget to submit it as a pull request once the code's on GitHub.
Re: Ghidra, NSA's reverse-engineering tool
#350Earlier quoted context omitted.
Hex-Rays can be hard to deal with, and the IC deals pretty extensively with large federal contractors like Raytheon, so it's possible they just needed something as capable as IDA that they could roll out across all their suppliers to use as a common toolchain and interchange format. But it's also possible this is just sort of a labor of love type thing.
There’s a third possibility: they wanted a piece of software they could customize to meet their needs. Admittedly, for simple bugfixes and the like, Hex-Rays’ support is known for being quite responsive (as suits the small number of customers). There’s also a quite large (albeit poorly-documented and crash-prone) SDK, which can handle a wide variety of needs and has gained functionality over time. But if you want to…
I'm also in the situation where I'd like to try to reverse binaries for the custom PowerPC chips in Gamecube/Wii/Wii U. I'm wondering if it might be easier to rewrite the assembly such that the SIMD instructions are rewritten in terms of standard instructions, and then just use that. I hope it's possible.