Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra by NSA

github.com

Post reply on HN
Print view View original

131–140 of 231 posts

Re: Ghidra by NSA

#131

Post by dang »

alexrp wrote: post #44

Binary Ninja deserves a mention in these threads: https://binary.ninja I've used IDA, Ghidra, and Binary Ninja a lot over the years. At this point I much prefer Binary Ninja for the task of building up an understanding of large binaries with many thousands of types and functions. It also doesn't hurt that its UI/UX feel like something out of this century, and it's very easy to automate using Python scripts.

One large-ish past thread and a few tinies, for anyone curious:

Binary Ninja – an interactive decompiler, disassembler, debugger - https://news.ycombinator.com/item?id=41297124 - Aug 2024 (1 comment)

Binary Ninja – 4.0: Dorsai - https://news.ycombinator.com/item?id=39546731 - Feb 2024 (1 comment)

Binary Ninja 3.0: The Next Chapter - https://news.ycombinator.com/item?id=30109122 - Jan 2022 (1 comment)

Binary Ninja – A new kind of reversing platform - https://news.ycombinator.com/item?id=12240209 - Aug 2016 (56 comments)

Re: Ghidra by NSA

#132

Post by dang »

Here are the main threads (in reverse order) that I found about Ghidra generally. Of course there have been many more threads about specific aspects or related projects: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que....

(Btw, these links are just for anyone curious to read more - reposts are fine after a year or so - https://news.ycombinator.com/newsfaq.html)

NSA Ghidra open-source reverse engineering framework - https://news.ycombinator.com/item?id=40508777 - May 2024 (61 comments)

Ghidra 11.0 Released - https://news.ycombinator.com/item?id=38740793 - Dec 2023 (11 comments)

Ghidra 10.3 has been released - https://news.ycombinator.com/item?id=35908418 - May 2023 (6 comments)

NSA Ghidra software reverse engineering framework - https://news.ycombinator.com/item?id=35324380 - March 2023 (103 comments)

Ghidra: Software reverse engineering suite developed by NSA - https://news.ycombinator.com/item?id=33226050 - Oct 2022 (42 comments)

Ghidra: A software reverse engineering suite of tools developed by the NSA - https://news.ycombinator.com/item?id=27818492 - July 2021 (142 comments)

Ghidra 9.2 - https://news.ycombinator.com/item?id=25086519 - Nov 2020 (78 comments)

The Ghidra Book - https://news.ycombinator.com/item?id=24879314 - Oct 2020 (5 comments)

Ghidra Decompiler Analysis Engine - https://news.ycombinator.com/item?id=19599314 - April 2019 (30 comments)

Ghidra source code officially released - https://news.ycombinator.com/item?id=19572994 - April 2019 (7 comments)

Ghidra Capabilities – Get Your Free NSA Reverse Engineering Tool [pdf] - https://news.ycombinator.com/item?id=19319385 - March 2019 (17 comments)

Ghidra, NSA's reverse-engineering tool - https://news.ycombinator.com/item?id=19315273 - March 2019 (405 comments)

Ghidra - https://news.ycombinator.com/item?id=19239727 - Feb 2019 (59 comments)

NSA to Release Their Reverse Engineering Framework GHIDRA to Public at RSA - https://news.ycombinator.com/item?id=18828083 - Jan 2019 (90 comments)

Re: Ghidra by NSA

#133

Post by gosub100 »

palata wrote: post #126
gosub100 wrote: post #105

Earlier quoted context omitted.

You were rude but I understand what you mean. People can obviously Google "reverse engineering tutorial" or something similar. And certainly "what are good resources for X" can be a way to signal interest in something, get people to respond, and not necessarily do anything about it. But I think the most charitable interpretation of that question is they want a group consensus for the best place to start, since Google…

> can be a way to signal interest in something, get people to respond, and not necessarily do anything about it. I can explain my intent, since I asked the question :-). "Signal interest in something in the hope of starting a discussion with people who share that interest and may have interesting stories to share". I loved IRC for that. I could join a channel, ask a question and sometimes someone knowledgeable would…

> I was trying to start a conversation with humans, that's all.

Totally fair, and I'm sorry you got a hostile response.

My (very low-value) opinion is don't waste your time learning how exploits work. Yeah it's kinda neat seeing clever misuse of components. But there is very little upside to investing in that knowledge.

0. You look at old exploits and marvel at them for a while, but they are long ago patched and technically useless.

1. You waste a bunch of time looking for a sploit but don't find one.

2. You find one but nobody cares, you don't get street cred. The sploit is patched in the next release, and you don't get back your time spent finding it.

3. You find a sploit but all you get is a thanks from the billion dollar company, followed by a patch.

4. You create an exploit and use it maliciously or sell it to a criminal syndicate. you are a criminal. Or you get sued because it's a civil/copyright issue.

5. You find a sploit and other people treat you as a criminal even though you didn't do anything with it. You even intended to help.

6. You find sploits but still can't get a job as a white hat because other people who found more sploits got the job.

The only good outcomes are:

7. You found a very clever sploit and got a bounty for it.

8. You got hired in cyber security and get paid for sploits or countering them.

9. You seriously just love decoding machine instructions and find joy from making it do unintended things.

Overall, I think the risk/reward ratio is suboptimal for this field unless you go black-hat which is obviously fraught with moral and legal hazards.

Re: Ghidra by NSA

#134

Post by stevekemp »

palata wrote: post #96
unleaded wrote: post #57

Earlier quoted context omitted.

Somewhat unconventional (and i'm not really a seasoned reverse engineer so take it with some salt) but I started by hacking old video games (nes, gameboy, arcade.. that kind of thing). You could start with making basic action replay RAM cheats to e.g. give Mario infinite lives, then you can use breakpoints, the debugger, and a 6502 ISA reference to edit instructions and make ROM patches. from then you can use things…

Thanks! I have been "hacking" with games in the past (getting infinite lives and such) or bypassing some licence check (back then it was with OllyDbg). I guess I'm struggling to transfer that to "real-life" scenarios. Like getting something useful out of reverse engineering (getting infinite lives is interesting to see that I can tamper with the game, but it's not exactly useful).

Honestly unless you're working in low-level fields, such as embedded hardware, or optimized code generation, those are real-life scenarios!

(Thinking more of license-checking, and serial-number generation rather than infinite lives.)

Re: Ghidra by NSA

#136

Post by boricj »

Might as well plug in my own extension: https://github.com/boricj/ghidra-delinker-extension

It's a relocatable object file exporter that supports x86/MIPS and ELF/COFF. In other words, it can delink any program selection and you can reuse the bits for various use-cases, including making new programs Mad Max-style.

It carved itself a niche in the Windows decompilation community, used alongside objdiff or decomp.me.

Re: Ghidra by NSA

#137

Post by dakolli »

Everyone in the comments is like, "take a look at this AI tool for Ghirda"

This is indicative of two things.

1. While I can't stand the guy, ya'll need to watch Peter Thiel's talk from 10-15 years ago at Stanford about not building the same thing everyone else is, a la, the obvious thing.

2. People are really attracted to using LLMs on deep thinking tasks, off shoring their thinking, to a "Think for me SaaS". This won't end well for you, there's no shortcuts in life that don't come with a (huge) cost.

The person who showed their work and scored A's on math tests instead of just learning how to use a calculator, is better off in their career/endevours than the 80% of others who did the latter. If Laurie Wired makes an MCP for Ghirda and uses it that's one thing, you using it without ever reverse engineering extensively is completely different. I'd bet my bottom dollar that Laurie Wired doesn't prefer the MCP over her own mental processes 8/10 times.

Re: Ghidra by NSA

#138

Post by dogma1138 »

WalterGR wrote: post #129
dogma1138 wrote: post #123

Earlier quoted context omitted.

BN is nice if someone is paying for it, but has too many limitations especially for the most common use case which is security.

What are the limitations?

No shellcode decoding, no plugin support and rather limited IR.

Re: Ghidra by NSA

#139

Post by WalterGR »

boricj wrote: post #136

Might as well plug in my own extension: https://github.com/boricj/ghidra-delinker-extension It's a relocatable object file exporter that supports x86/MIPS and ELF/COFF. In other words, it can delink any program selection and you can reuse the bits for various use-cases, including making new programs Mad Max -style. It carved itself a niche in the Windows decompilation community, used alongside objdiff or decomp.me.

What is Mad Max-style?
Post reply on HN