Analysis of large binaries and games in Ghidra-SRE
1–10 of 25 posts
Re: Analysis of large binaries and games in Ghidra-SRE
#2Kind of expected a writeup of findings from an example, but it just looks like a how-to article.
Re: Analysis of large binaries and games in Ghidra-SRE
#3Kind of expected a writeup of findings from an example, but it just looks like a how-to article.
And the biggest takeaway to me was that the software is still heavily bugged, especially the UI.
Re: Analysis of large binaries and games in Ghidra-SRE
#4Ghidra is really neat, so a couple times I've tried to do reversing of small games through it to practice.
Turns out stuff is really hard, despite Ghidra doing a bunch of work to try and get things to be super easy. Even for really small old indie windows games I think you really have to have a good idea of what kind of tools the people are using to get places. That or get really lucky in a string search :)
Re: Analysis of large binaries and games in Ghidra-SRE
#5Co-pilot like tool hooked-in to guess meaning of reverse engineered code would be awesome ;)
Re: Analysis of large binaries and games in Ghidra-SRE
#6Ghidra is really neat, so a couple times I've tried to do reversing of small games through it to practice. Turns out stuff is really hard, despite Ghidra doing a bunch of work to try and get things to be super easy. Even for really small old indie windows games I think you really have to have a good idea of what kind of tools the people are using to get places. That or get really lucky in a string search :)
It's more like you need to have cut your teeth before on SW development and RE since you need a good gut feeling of what bundle of assembly lines/C code correspond to what kind of functionality the developer had in mind.
Trying to RE production SW without any prior development experience is brutally hard.
Re: Analysis of large binaries and games in Ghidra-SRE
#7[deleted]
Re: Analysis of large binaries and games in Ghidra-SRE
#8I recently started analysing a game with Ghidra. I found the plugin mentioned was actually fairly useless in my case (but this was version 9, maybe things have changed), instead I used OOAnalyzer [1] and its associated Ghidra plugin - great for bootstrapping a class hierarchy, which is otherwise extremely tedious to do. It took 24 hours and ~100GB of memory, so I ran it on AWS, splitting the analysis in parts according to [2]. Also I’d recommend looking into scripting, it can save you a lot of time in repetitive scenarios.
[1] https://github.com/cmu-sei/pharos/blob/master/tools/ooanalyz... [2] https://github.com/cmu-sei/pharos/blob/master/share/prolog/o...
Re: Analysis of large binaries and games in Ghidra-SRE
#9I started reverse engineering a game about 3 months ago with no prior experience. It is insanely difficult. I like to think that I have very good pattern recognition and investigative skills, I find most problems surmountable given enough time. But I'm barely making any progress and am tearing my hair out just to find tiny breadcrumbs of clues. Maybe this is one of those things where picking up a few books is imperative.
In software development, we share massive amounts of information, and there's always a premade tool out there that does what you need and will work the first time. This isn't my experience in the reverse engineering world. Information is sparse, seems to be kept private, and there's not always a tool that does what you want. Even if there is, good luck getting it to work.
Re: Analysis of large binaries and games in Ghidra-SRE
#10Co-pilot like tool hooked-in to guess meaning of reverse engineered code would be awesome ;)
This is an amazing idea!