Few years in with debugger support, how does Ghidra compare to IDA?
Ghidra: A software reverse engineering suite of tools developed by the NSA
11–20 of 147 posts
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#12Earlier quoted context omitted.
>although I don't think the NSA can just install anything on my computer If it's not connected to a network you are probably right....otherwise 100% wrong, if your a enough valuable target. And just lets say for fun your OS is 100% bulletproof, your +30 firmware's are not.
I doubt it. From operations that went public the attack vectors are known and you can extrapolate something about their capabilities. Of course they could get access if I were a valuable target, but that might just as well be with a large wrench. But they cannot just take control of any device. And I think many companies might even have better capabilities. Or defense, since intelligence work is very often about indu…
>From operations that went public
Are you talking about Snowden's powerpoint slides or the Shadow Brokers arsenal?
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#13It is open source software and it can reverse engineer programs from a lot of different systems. Some people may be worried about installing a piece of software on their computer that comes from the NSA. I don't think that there are real reasons to worry. One of the tasks of the NSA is defending against cyber attacks. Having more people with good tools helps the defense. Also, you can be pretty certain that some secu…
I would be curious to know if anyone has audited this for malicious code, or how one would go about doing that in the first place. Is that kind of software auditing a use case for Ghidra? A demo of using Ghidra to audit Ghidra would be interesting I suppose.
Its used to reverse engineer an unknown binary without the matching source code. Since Ghidra already is open source it be no use to audit Ghidra itself except for learning purposes. It might be useful to reverse engineer a closed source driver so you can write an open source one from scratch.
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#14I'm not sure why this is news. It is an amazing bit of kit, and cross platform. I've been using g it for many months now and highly recommend it.
For you it is obviously not news, but for other people it probably is. For me, HN is about learning something new, not just for learning about something that happened in the last 24 hours.
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#15Earlier quoted context omitted.
>although I don't think the NSA can just install anything on my computer If it's not connected to a network you are probably right....otherwise 100% wrong, if your a enough valuable target. And just lets say for fun your OS is 100% bulletproof, your +30 firmware's are not.
I doubt it. From operations that went public the attack vectors are known and you can extrapolate something about their capabilities. Of course they could get access if I were a valuable target, but that might just as well be with a large wrench. But they cannot just take control of any device. And I think many companies might even have better capabilities. Or defense, since intelligence work is very often about indu…
Wisen up.
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#16I'm not sure why this is news. It is an amazing bit of kit, and cross platform. I've been using g it for many months now and highly recommend it.
For you it is obviously not news, but for other people it probably is. For me, HN is about learning something new, not just for learning about something that happened in the last 24 hours.
Potentially news to those who recently got into coding/hacking. Ghidra was leaked in '17 and made headline news. Then officially released by the NSA in '19.
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#17Few years in with debugger support, how does Ghidra compare to IDA?
I like Ghidra more than IDA. Having "proper" type support is nice - IDA's struct and type annotation support always felt very hacked together and hard to use. Ghidra's typing and decompiler is good enough that I don't even have to look at the disassembly listing for most functions, and struct autogenerating is wonderful.
Unfortunately, Ghidra handles vtables and OOP very poorly still. You have to do a lot of by-hand annotations for virtual calls, even with 3rd party analysis scripts, while IDA's C++ usually Just Works. This is the main pain point, imo. The other main thing is that IDA has been used by the reverse engineering community for so long that there's a massive body of tutorials and StackOverflow answers for it, and a much larger corpus of 3rd party plugins. It's not a big deal for me, personally, but if you already have a good workflow for IDA it's probably not worth it to switch. For beginners I'd recommend Ghidra instead, though, because a free and open source tool with good official documentation and UX is worth its weight in gold (although I've heard BinaryNinja is extremely good nowadays).
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#18Earlier quoted context omitted.
For you it is obviously not news, but for other people it probably is. For me, HN is about learning something new, not just for learning about something that happened in the last 24 hours.
Potentially news to those who recently got into coding/hacking. Ghidra was leaked in '17 and made headline news. Then officially released by the NSA in '19.
Because you know everything that made the headlines up to 2017?
There might or might not be discussion potential on any submission, so I understand arguing about their value, but that "news if you're a beginner" was very condescending. Why not be happy about today's lucky 10,000?
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#19I'm not sure why this is news. It is an amazing bit of kit, and cross platform. I've been using g it for many months now and highly recommend it.
For you it is obviously not news, but for other people it probably is. For me, HN is about learning something new, not just for learning about something that happened in the last 24 hours.
I once was a total jerk on a mailing list (okay in my youth I was a jerk many times on mailing lists).
Someone shared an article I had seen earlier that year. “Why would you share this? This is old news it’s already made the rounds on the web.” Like I expected everyone to have the same experience as me. Luckily someone told me to chill out or I’d be blocked, that the list was for any news people found interesting. I felt very embarrassed and didn’t post there again for a long time, but it was my own fault.
Re: Ghidra: A software reverse engineering suite of tools developed by the NSA
#20Earlier quoted context omitted.
Potentially news to those who recently got into coding/hacking. Ghidra was leaked in '17 and made headline news. Then officially released by the NSA in '19.
Because you know everything that made the headlines up to 2017? There might or might not be discussion potential on any submission, so I understand arguing about their value, but that "news if you're a beginner" was very condescending. Why not be happy about today's lucky 10,000?
> Because you know everything that made the headlines up to 2017?
No, and I didn't mean to sound condescending. I'll take out the "only" in my message.
Edit: And to clarify what I meant, I may not have known every headline in 2017, but I sure as hell heard about most of the Vault 7 releases. An organization anonymously releasing a world power's cyber tooling is something out of a cyberpunk novel.