Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

381–390 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#381
post #247

Earlier quoted context omitted.

"Eschew flamebait. Don't introduce flamewar topics unless you have something genuinely new to say. Avoid unrelated controversies and generic tangents." https://news.ycombinator.com/newsguidelines.html

OP does have a point that this software was subsidized by tax payers. One could argue the NSA needs advanced tools and that the costs of IDA Pro add up.

This, unfortunately, occurs so infrequently that it can safely be ignored by 99.9% of the economy. Businesses have really enjoyed having their cake and eating it too with the transition away from a highly involved acquisition process that generally resulted in a tailored solution that the USG owned, to the present COTS policy that allows them to then go on to sell software to people that have already effectively paid for it through taxes. While there was an impressive amount of bureaucracy and an infinitely self referential system of standards in the old method, it did lead to some pretty interesting side effects: Ada[0], IDEF[1], MIL-STD-498[2], etc.

The most recent liberation of useful taxpayer funded software that I can think of was over ten years ago, when NIST released NFIS2 - the fingerprint software that the FBI relied on. They of course had to be crappy about it and wrap it in export controls that limited its utility, but it was interesting to see all the work that internal development had done - very polished, with man pages going back to '97. Ah the memories: software classified as munitions, the clipper chip...

[0] http://archive.adaic.com/pol-hist/policy/naig94-1.txt

[1] https://en.wikipedia.org/wiki/IDEF#The_IDEF_modeling_languag...

[2] https://en.wikipedia.org/wiki/MIL-STD-498

[3] https://web.archive.org/web/20041206072946/http://fingerprin...

Re: Ghidra, NSA's reverse-engineering tool

#382
post #38

Earlier quoted context omitted.

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.

Being open-sourced is a big advantage. I just fixed a bug in GHIDRA relating to trackpad scrolling which makes it MUCH more usable for me. I could never do the same with IDA or Binary Ninja. I do so love the shell code compiler of Binary Ninja, though. It works very well and has definitely saved me a lot of time.

Speak of the devil—I was just thinking about diving in to fix that issue. Thank you! :)

Re: Ghidra, NSA's reverse-engineering tool

#383
post #199

Earlier quoted context omitted.

It's not Open Source.

If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).

JetBrains.

Re: Ghidra, NSA's reverse-engineering tool

#384
post #161
post #148

Earlier quoted context omitted.

Binja is the only real competitor in any remote sense IMO, and while the LLIL/MLIL are nothing compared to Hex-Rays, they do still dramatically improve the speed of the job. Binja is also fairly extensible/pluggable, though it's pretty undocumented... I just don't do it enough in my spare time these days (not in the field anymore) to justify a Hex-Rays license for myself (even if it is permanent...) That said I just…

I agree, they have a big potential. But if you speak about FOSS alternative - there is already radare2[1]+Cutter[2]+radeco[3]. [1] https://github.com/radare/radare2 [2] https://github.com/radareorg/cutter [3] https://github.com/radareorg/radeco

Binary-Ninja and IDA are a completely different class of tool from Radare. Don't get me wrong, I'm happy Radare exists. And I occasionally check it out and play with it -- I think "the vim of RE tools" is a cool point in the design space. As a Linux person, I find that attractive, especially for certain kinds of automated stuff (vs loading Python scripts in through a UX or whatever). But that kind of aesthetic is an extremely small part of these tools in the whole, and it simply does not matter if the tool cannot "keep up" with your work. All of that comes later on. You're comparing a Jalopy to a Prius -- and that Prius is already going up against a Ferrari.

When I use IDA, almost all of my actual work in the tool itself is very "boring" RE stuff, because it does its job. I am not constantly fighting with it to get basic things analyzed propertly, or fighting a lack of supported features that prevent it from opening something, or a bad analysis engine that misses 80% of things I later reverse by hand. You could comparatively stitch something together with the tools in Radare to patch over this for the cases it doesn't handle. You might even call those "edge cases", but reverse engineering is 90% edge cases and 10% easy stuff. I'll already be done by then.

I should also be clear that part of the issue is that reverse engineering is a money game, one where money is easy to come by if you have the clients -- and as a result and a lot of the developers of those tools have more money/labor available than the Radare developers. That also means people who need this can simply throw money at a problem, like an expensive IDA license, and move on. That doesn't mean Radare developers are incompetent. If you gave them a lot of money -- like, enough to fund 5-10 core developers for a couple years -- Radare would dramatically improve extremely quickly, I'm sure. (This is one of the reasons why I suspected a true competitor to IDA would never come around as FOSS -- it takes a shitload of money to do that, and it's also something you can make a shitload of money from.)

But I'll say this: if you put me into a situation where I had to reverse something, I'd pay for an IDA license 10/10 times even if every Radare developer was at my command, and I'd probably still get it done faster (most RE tools I know of lack even the most basic, fundamental features IDA has had for years -- such as FLIRT -- that can dramatically improve reversing speed.)

Re: Ghidra, NSA's reverse-engineering tool

#386
post #199

Earlier quoted context omitted.

It's not Open Source.

If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).

Evan You (creator of VueJS) makes ~$16k a month on Patreon, plus an untold amount of fees for speaking at conferences. They also have an open collective which at the momement has a budget of just under $67k/year. It's hard to say what the money is actually used for, but at least some is used to pay for "VueJS maintenance" which probably goes towards paying Evan as well.

Re: Ghidra, NSA's reverse-engineering tool

#387
post #102

Earlier quoted context omitted.

To be fair, there's definitely a difference between downloading a pirated version of software, and actually leaking copies of software for others to pirate. The DataRescue and now Hex-Rays folks seem particularly sensitive to leaked copies and I imagine leaked copies genuinely do affect their bottom line of sales given the kinds of markets they're in.

They certainly seemed to be very much against selling it to private individuals (or were when I asked many years ago). I guess unless you've got a CV which says "presented at Defcon and Blackhat, five times" or "currently work at {big infosec company}", even if you can afford it the answer will be "nope". The end result for me was that I bought a Mac Mini and a copy of Hopper and Synalyze It. My entire reverse-engine…

That seems odd. Why do they turn down paying customers?

Re: Ghidra, NSA's reverse-engineering tool

#388
post #199

Earlier quoted context omitted.

If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).

Evan You (creator of VueJS) makes ~$16k a month on Patreon, plus an untold amount of fees for speaking at conferences. They also have an open collective which at the momement has a budget of just under $67k/year. It's hard to say what the money is actually used for, but at least some is used to pay for "VueJS maintenance" which probably goes towards paying Evan as well.

Thanks for this information, it helps. The issue for me is that the target audience is probably < 10k people globally. The tool would act as a serious productivity multiplier for those 10k people (and those people are very well paid). In Evans case his creation is not only awesome, it also has a large target audience.

Re: Ghidra, NSA's reverse-engineering tool

#389
post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

Out of curiosity what kind of job involves doing binary reverse engineering full time?

Well there are these, at my workplace: https://news.ycombinator.com/item?id=19055183

That includes malware analysis, vulnerability research, and emulator development.

Re: Ghidra, NSA's reverse-engineering tool

#390

I'm curious what feature specifically prompted the NSA to develop their own IDA Pro alternative. I mean, someone somewhere at the NSA must have been trying to do something with IDA Pro only to repeatedly fail before the decision was made that whatever the NSA was trying to do warranted developing their own IDA Pro... right? Or perhaps they used IDA Pro so often and grew so frustrated by it that they started their own…

May be the NSA probably had this before IDA came about. It’s the NSA after all. They are now releasing it because it’s not a competitive edge anymore and can be used as a recruiting tool.

I don't think that is possible. I used early versions of IDA Pro on MS-DOS in 1996... and it had the core analysis and interactive disasm mode then. Ghidra seems to be based on this very concept, all the way down to the "XREF" labels. Even the sub-panels in the UI look the same: Imports, Exports, Symbols...
Post reply on HN