Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

371–380 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#371

Post by vharuck »

xxpor wrote: post #131

Why do they have a LICENCE file with the Apache Licence in it? As a work of the federal government this is public domain by definition, isn't it? edit: Oh, outside contributors of course retain their own copyright. That's what's licenced. https://github.com/NationalSecurityAgency/ghidra/blob/master...

A common work-around is for a federal agency to hire a contractor to write software and require the copyright be transferred as part of the contract. The federal government can hold copyrights, so it's legally kosher.

Re: Ghidra, NSA's reverse-engineering tool

#372

Post by occamrazor »

comex wrote: post #178
tptacek wrote: post #137

Earlier quoted context omitted.

Hex-Rays can be hard to deal with, and the IC deals pretty extensively with large federal contractors like Raytheon, so it's possible they just needed something as capable as IDA that they could roll out across all their suppliers to use as a common toolchain and interchange format. But it's also possible this is just sort of a labor of love type thing.

There’s a third possibility: they wanted a piece of software they could customize to meet their needs. Admittedly, for simple bugfixes and the like, Hex-Rays’ support is known for being quite responsive (as suits the small number of customers). There’s also a quite large (albeit poorly-documented and crash-prone) SDK, which can handle a wide variety of needs and has gained functionality over time. But if you want to…

> In general I’m surprised that “paid + source access for customers” isn’t a more popular model of software development.

Microsoft has a "shared source" agreement with governments.

Re: Ghidra, NSA's reverse-engineering tool

#373

Post by alexozer »

tptacek wrote: post #357
alexozer wrote: post #345

Earlier quoted context omitted.

I believe Capstone is merely a disassembly framework, and retdec's decompilation process is custom implementation which works on LLVM IR.

Yeah, sorry, as I understand it, it uses Capstone as the disassembler and implements an LLVM lifter over it. It was pretty dumb to describe it as "based on Capstone"; I was just mentally breaking tools down by which CFG recovery system it relied on.

No worries, it wasn't dumb to say that! Your intention just wasn't 100% clear to me.

Re: Ghidra, NSA's reverse-engineering tool

#374

Post by nneonneo »

AsyncAwait wrote: post #310
nneonneo wrote: post #239

Earlier quoted context omitted.

Being open-sourced is a big advantage. I just fixed a bug in GHIDRA relating to trackpad scrolling which makes it MUCH more usable for me. I could never do the same with IDA or Binary Ninja. I do so love the shell code compiler of Binary Ninja, though. It works very well and has definitely saved me a lot of time.

Awesome! Please don't forget to submit it as a pull request once the code's on GitHub.

Of course. In the meantime I posted patched binaries to the relevant issue: https://github.com/NationalSecurityAgency/ghidra/issues/2#is...

As soon as the code is up I hope to submit a PR, which will be pretty easy since I already have the diff.

Re: Ghidra, NSA's reverse-engineering tool

#375

Post by blincoln »

tptacek wrote: post #57
_wmd wrote: post #37

Earlier quoted context omitted.

For which they charge a per-CPU fortune https://www.hex-rays.com/cgi-bin/quote.cgi

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

I think IDA's lack of significant competition until now is nearly a textbook example of how charging a lot for a tool is no indication that the funds will go toward improving the quality.

What's been significantly improved in IDA over the last 10-15 years? Certainly not the x86 decompiler, which costs something like five times as much as IDA itself. The interface is still super-clunky and missing functionality like keyboard shortcuts for frequently-used functions.

I'm ecstatic that there's finally a realistic alternative.

Re: Ghidra, NSA's reverse-engineering tool

#377

Post by jjoonathan »

psifertex wrote: post #355
jjoonathan wrote: post #340

Earlier quoted context omitted.

No, they never replied at all. Their self-service site broke and they completely and utterly ignored my emails to the associated service address and to a number of other addresses posted on their site. I grew up using, ah, other methods of satisfying my need for an interactive debugger and those methods continued to be viable after giving hex-rays $1100 and getting flaked, so I wasn't materially impacted by the flake…

This is really strange to hear. What self service site did you use? Our website chat goes right to a slack channel that multiple folks monitor and reply to at all hours of the day. Worst case if we're all sleeping and you leave an email we respond when we're awake. Just searched for your username in our chat and our email and don't see anything so I assume you've got a different email?

My problems were with an IDA Pro license I purchased from hex-rays. I have no complaints about BinaryNinja. If you represent hex-rays I'd be happy to PM you my business email.

Re: Ghidra, NSA's reverse-engineering tool

#378

Post by jjoonathan »

psifertex wrote: post #359
jjoonathan wrote: post #158

Earlier quoted context omitted.

And they didn't take my money, break my key in an update, and ghost me while I was still in the support period. So they've got that going for them.

Oh also, just to clarify -- are you talking about Binary Ninja or something else? That would explain a lot of my confusion. :-P

I'm complaining about IDA. I have no complaints about BinaryNinja :-)

Re: Ghidra, NSA's reverse-engineering tool

#379

Post by jjoonathan »

maerF0x0 wrote: post #358
psifertex wrote: post #353

Earlier quoted context omitted.

I'm sorry you had a bad experience. This is the first I've heard about it! We normally get nothing but praise during any customer support interaction. Feel free to email me directly (jordan at vector35 com) with your email address so I can try to figure out what happened. Apologies it didn't go well.

I think parent was saying that Binary Ninja _didnt_ do those things (implying that IDA did).

Yep.

Re: Ghidra, NSA's reverse-engineering tool

#380

Post by blattimwind »

nneonneo wrote: post #215
emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

Ghidra also appears to have a functioning Undo operation, which IDA seems to still not have. Being able to make changes without worrying about your IDB accidentally becoming unusable is huge . Context: in IDA, certain changes you make can inadvertently wipe out a lot of work - for example, undefining a function (U) can erase all your annotations in a single keystroke; defining a return type incorrectly can completely…

I don't think I've ever seen an application where a working undo function was added in a posteriori. You either design it in from the start or you don't get a working one or you have to rewrite most of the application.
Post reply on HN