Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra by NSA

github.com

Post reply on HN
Print view View original

41–50 of 231 posts

Re: Ghidra by NSA

#41

Post by bri3d »

q3k wrote: post #40
flipped wrote: post #35

Earlier quoted context omitted.

Almost every hobbyist reverse engineer uses cracked IDA which is easily available. I have never seen ghidra being recommended for serious work.

I recommend it for serious work. Well, serious enough that I got paid for doing it, and/or given talks about it. (not if you're only doing x86/ARM stuff, though)

Agree. IDA is surely the “primary” tool for anything that runs on an OS on a common arch, but once you get into embedded Ghidra is heavily used for serious work and once you get to heavily automation based scenarios or obscure microarchitectures it’s the best solution and certainly a “serious” product used by “real” REs.

Re: Ghidra by NSA

#42

Post by xvilka »

aktau wrote: post #34
xvilka wrote: post #2

Cutter[1] by RizinOrg[2]. [1] https://github.com/rizinorg/cutter [2] https://github.com/rizinorg/rizin

+1 I once tried learning how to RE with radare2 but got very frustrated by frequent project file corruption (meaning radare2 could no longer open it). The way these project files work(ed?) in radare2 at the time was that it just saved all the commands you executed, instead of the state. This was brittle, in my experience. I don't have a lot of free time, so I have to leave projects for long periods of time, not being…

Yes, we are working on rewriting analysis completely[1][2] that would fix your issue along with many others.

[1] https://github.com/rizinorg/rizin/pull/5505

[2] https://github.com/rizinorg/rizin/issues/4736

Re: Ghidra by NSA

#43

Post by xvilka »

q3k wrote: post #38
19h wrote: post #28

Earlier quoted context omitted.

Which exotic architectures is IDA missing from your perspective?

Stuff I've recently analyzed that IDA has no decomp support for (and Ghidra's is anywhere from good enough to actually good): - AVR - Z80 - HC08 - 8051 - Tricore - Xtensa - WebAssembly - Apple/Samsung S5L87xx NAND controller command sequencer VLIW (custom SLEIGH) And probably more that I've forgotten. It's also not about lack of support, but the fact that you have to pay extra for every single decompiler. This sucks…

Binary Ninja supports some of them as well, highly recommend.

Re: Ghidra by NSA

#44

Post by alexrp »

Binary Ninja deserves a mention in these threads: https://binary.ninja

I've used IDA, Ghidra, and Binary Ninja a lot over the years. At this point I much prefer Binary Ninja for the task of building up an understanding of large binaries with many thousands of types and functions. It also doesn't hurt that its UI/UX feel like something out of this century, and it's very easy to automate using Python scripts.

Re: Ghidra by NSA

#45

Post by q3k »

xvilka wrote: post #43
q3k wrote: post #38

Earlier quoted context omitted.

Stuff I've recently analyzed that IDA has no decomp support for (and Ghidra's is anywhere from good enough to actually good): - AVR - Z80 - HC08 - 8051 - Tricore - Xtensa - WebAssembly - Apple/Samsung S5L87xx NAND controller command sequencer VLIW (custom SLEIGH) And probably more that I've forgotten. It's also not about lack of support, but the fact that you have to pay extra for every single decompiler. This sucks…

Binary Ninja supports some of them as well, highly recommend.

I really want to like Binary Ninja, but whenever I have the choice between not paying (Ghidra), paying for something that I know works (IDA) and paying for something that I don't know if it works (Binja) then the last option has always lost so far.

Maybe we need to get some good cracked^Wcommunity releases of Binja so that we can all test it as thoroughly as IDA. The limited free version doesn't cut it unfortunately - if I can't test it on what I actually want to use it for, it's not a good test.

(also it doesn't have collaborative analysis in anything but the 'call us' enterprise plan)

Re: Ghidra by NSA

#46

Post by tomasphan »

quux0r wrote: post #31

While on the topic, I want to highlight two incredible plugins for Ghidra: https://github.com/jtang613/GhidrAssist And https://github.com/jtang613/GhidrAssistMCP Being able to hook Claude code up to this has made reversing way more productive. Highly recommend!

How willing is Claude to help you there?

Re: Ghidra by NSA

#48

Post by xvilka »

alexrp wrote: post #44

Binary Ninja deserves a mention in these threads: https://binary.ninja I've used IDA, Ghidra, and Binary Ninja a lot over the years. At this point I much prefer Binary Ninja for the task of building up an understanding of large binaries with many thousands of types and functions. It also doesn't hurt that its UI/UX feel like something out of this century, and it's very easy to automate using Python scripts.

In particularly I like their approach of creating modern IR pipeline.

Re: Ghidra by NSA

#49

Post by ramuel »

palata wrote: post #20

Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an experienced developer, but not so experienced in reverse engineering? I guess one issue I have is that I don't have good ideas of fun projects, and that's probably something I need to actually get the motivation to learn. I can find a "hello world", that's easy,…

https://pwn.college has really good modules/dojos that cover a bunch of reverse engineering concepts.

Re: Ghidra by NSA

#50

Post by kaibee »

reactordev wrote: post #15
jeevacation wrote: post #11

[flagged]

No. Cheat engine scans memory as a program is running, for values of interest to pin (or modify). Allowing you to change behavior. Ghidra takes a program and unravels the machine code back into assembly and thus, something resembling C code. Allowing you to change behavior. Cheat Engine doesn’t modify the binary. Ghidra can.

> Cheat Engine doesn’t modify the binary. Ghidra can.

To clarify for other people who may not be familiar, (though I'm far from an expert on it myself) you can inject/modify asm of a running binary with CE. I'm not sure if there's a way to bake the changes to the exe permanently.

Post reply on HN