Ghidra, NSA's reverse-engineering tool • Hacker News Board

Re: Ghidra, NSA's reverse-engineering tool

#361

Post by S-E-P » Wed, Mar 06, 2019, 5:06 PM UTC

smolsky wrote: post #352

emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

Let's not forget https://www.radare.org which is trying to be a OSS IDA Pro.

I use r2 almost all the time, it's just so fast and convenient, and it makes working with Binary Ninja easier. Also use IDA when all else fails.

And the decompiler is dope for IDA

Re: Ghidra, NSA's reverse-engineering tool

#362

Post by ddtaylor » Wed, Mar 06, 2019, 5:07 PM UTC

dang wrote: post #247

Tepix wrote: post #244

Earlier quoted context omitted.

I'm surprised that noone is yelling "socialism" yet. Tax paid competition for existing commercial products. Isn't that considered evil/wrong by pure capitalists?

"Eschew flamebait. Don't introduce flamewar topics unless you have something genuinely new to say. Avoid unrelated controversies and generic tangents." https://news.ycombinator.com/newsguidelines.html

OP does have a point that this software was subsidized by tax payers. One could argue the NSA needs advanced tools and that the costs of IDA Pro add up.

Re: Ghidra, NSA's reverse-engineering tool

#363

Post by maerF0x0 » Wed, Mar 06, 2019, 5:10 PM UTC

kevinchen wrote: post #143

This is an unusually large open source project, especially for NSA. I wonder whether they were motivated to release this tool because of their recent brain drain / hiring problems.

Here's a potential angle: If you're going to use a tool internally it's in your best interest to be able hire people w/ experience with that tool. (ie, people learn the tool for free on their own time)

Re: Ghidra, NSA's reverse-engineering tool

#364

Post by jeffreyrogers » Wed, Mar 06, 2019, 5:16 PM UTC

janekm wrote: post #264

perlgeek wrote: post #232

Earlier quoted context omitted.

4. Managing licenses is a huge PITA, presumably especially in environments with lots of classified information.

Good point... "we need a site license. No, I can't tell you for how many employees, that's classified. No, I can't tell you who we are, that's classified. No, I can't tell you what we are working on, that's classified. Hello? Hello? Darn they hung up again..."

When I worked for a hedge fund we had to deal with this sort of thing (not classified obviously, but wanted exemptions from certain things), but it was actually pretty easy to deal with. They just charge you more to get custom terms.

Re: Ghidra, NSA's reverse-engineering tool

#365

Post by X-Istence » Wed, Mar 06, 2019, 5:23 PM UTC

psifertex wrote: post #355

jjoonathan wrote: post #340

Earlier quoted context omitted.

No, they never replied at all. Their self-service site broke and they completely and utterly ignored my emails to the associated service address and to a number of other addresses posted on their site. I grew up using, ah, other methods of satisfying my need for an interactive debugger and those methods continued to be viable after giving hex-rays $1100 and getting flaked, so I wasn't materially impacted by the flake…

This is really strange to hear. What self service site did you use? Our website chat goes right to a slack channel that multiple folks monitor and reply to at all hours of the day. Worst case if we're all sleeping and you leave an email we respond when we're awake. Just searched for your username in our chat and our email and don't see anything so I assume you've got a different email?

He's talking about IDA Pro.

Re: Ghidra, NSA's reverse-engineering tool

#366

Post by morenoh149 » Wed, Mar 06, 2019, 5:25 PM UTC

How did they use jenkins to do this exactly? I'm curious

Re: Ghidra, NSA's reverse-engineering tool

#367

Post by Nanocurrency » Wed, Mar 06, 2019, 5:29 PM UTC

z3phyr wrote: post #276

Just used it to solve the 2015 flare-on challenge #1. Rudimentary, but I am blown away. The interface feels better than IDA, I was able to write a python script straight away! 10/10 recommended. The python interpreter attached with it is aware of the state. Where is my cursor, what memory module I have selected etc. Easy to write scripts for

Any chance you could do a few videos tutorials on using it in conjunction with Python?

Re: Ghidra, NSA's reverse-engineering tool

#368

Post by debatem1 » Wed, Mar 06, 2019, 5:29 PM UTC

tptacek wrote: post #57

_wmd wrote: post #37

Earlier quoted context omitted.

For which they charge a per-CPU fortune https://www.hex-rays.com/cgi-bin/quote.cgi

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

Reverse engineering doesn't pay that well-- IME at or just below par with software engineers.

So as one point of comparison you might look at the tools of software engineers, which are essentially all free today.

To get to hex-rays having a reasonable price you probably have to look at jobs like pipe welding where the equipment is expensive and the hourly high, but the comparison is much less direct.

Re: Ghidra, NSA's reverse-engineering tool

#369

Post by meditate » Wed, Mar 06, 2019, 5:34 PM UTC

anyzen wrote: post #302

jazzyjackson wrote: post #221

Earlier quoted context omitted.

Yeah, the question was about getting paid to develop open source software. The answer is, sell support.

Wrong answer. Selling support means that the developer is incentivized to make product unnecessarily complex. Also, with recent developments it turns out that other entities might be better at providing support than original developers, taking away the option to monetize OSS. Why bother writing your own software, when you can just sell services and provide support for a different one? Note that RedHat, often quoted a…

I don't see this as an incentive specific to FOSS. Most customers of any software tend to demand increasingly complex featuresets as time goes on.

Re: Ghidra, NSA's reverse-engineering tool

#370

Post by debatem1 » Wed, Mar 06, 2019, 5:49 PM UTC

pbhjpbhj wrote: post #294

justinjlynn wrote: post #283

Earlier quoted context omitted.

Yeah, but it is the market - it's just not a perfect market; you know, the kind that can't exist.

No, "the market" means financial considerations created an opportunity that was fulfilled to generate profit. It could be that the economy gained via this FOSS release, and that was part of the consideration, but that would be structural interference by the government (which can be a good thing IMO) working in opposition to the market. Market forces are often reined in, eg by human rights, those things aren't part of…

Hmm? Large customer of leading widget manufacturer decides to make its own widgets in-house instead and keep the build minus buy money (plus possibly getting a better widget). Totally normal market practice.

Large player in widget market has low marginal cost and deep pockets, sells widgets at marginal cost its competitors can't match. Also totally normal market practice.

Competitors exit market or are relegated to minor market share, leaving de facto sole survivor. Also totally normal market practice.

We could be talking about chrome just as easily as IDA pro here.