Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra by NSA

github.com

Post reply on HN
Print view View original

171–180 of 231 posts

Re: Ghidra by NSA

#171

Post by zmgsabst »

user3939382 wrote: post #169

I miss the analog of this community from the 90s. We had actual principles and ethos and wouldn’t have been caught dead upvoting and using software from the frickin NSA. Not that it’s any surprise here. Contemporary San Francisco driven software culture which is the majority represented on this forum have no qualms with FAANG ethics, open source is not really important either. Oh I’m sorry the NSA didn’t spy on the w…

Having been in Seattle, I’m not sure there was a time the NSA wasn’t involved with technology — eg, UW hosted meetups between researchers, criminals, and the government at least that long.

Who built the Echelon follow-up, proto-dragnet system that provided the framework for the spying you bemoan? — the one extended and taken live in the early 2000s? Those same 90s hackers you glorify.

Re: Ghidra by NSA

#172

Post by boricj »

montymintypie wrote: post #168
boricj wrote: post #136

Might as well plug in my own extension: https://github.com/boricj/ghidra-delinker-extension It's a relocatable object file exporter that supports x86/MIPS and ELF/COFF. In other words, it can delink any program selection and you can reuse the bits for various use-cases, including making new programs Mad Max -style. It carved itself a niche in the Windows decompilation community, used alongside objdiff or decomp.me.

Easily one of the coolest RE projects out there, I've always looked on in awe. > The relocation table synthesizer analyzer relies on a fully populated Ghidra database (with correctly declared symbols, data types and references) in order to work It's a shame that this requirement exists (I am well aware that it's a functional necessity), because all the stuff I want to relink is far too big to make a full db!

You only need a full DB if you want to fully delink your artifact. You can just clean up the subset you're interested in exporting (the fully populated disclaimer is just there because there's a lot you can get away with, as long as you know precisely what you are doing).

Even then, a full DB is quite achievable, even on large projects. The biggest public project using ghidra-delinker-extension out there is the FUEL decompilation: https://github.com/widberg/FUELDecompilation

The executable is 7 MiB, has over 30,000 functions and has more than 250,000 relocations spots. The user made the game relocatable in six weeks (with four of them debugging issues with my extension). They then managed to replace code in spite of the fact that the artifact was built with LTO by binary patching __usercall into MSVC.

There's a write-up about all of that that is well worth a read: https://github.com/widberg/fmtk/wiki/Decompilation

I've also had one user manage to fully delink the original Halo on the Xbox in one week. To be fair, they were completely nerd-sniped and worked non-stop on it, but it still counts.

Re: Ghidra by NSA

#173

Post by throwerxyz »

baby_souffle wrote: post #148
palata wrote: post #97

Earlier quoted context omitted.

Oh, it feels like it may be what I want! Find some cheap electronic device and hack it! Thanks a lot!

I would also suggest spending a few minutes to set up an mCP server with ghidra once you've learned the basics of navigating and working inside of ghidra. Turns out that frontier grade llms are absolutely fantastic for extremely advanced static analysis. If you go one step further and manage to get your firmware running inside of an emulator or other place where you can attach GDB... Then putting an mCP server on tha…

Would that include free use LLMs. I assume getting into something would be tricky if you are assuming they're going to drop several hundreds of tokens a month on it.

I feel like the tendency for people to assume others have nearly $500 or so of credits on their AI to blow every month is kinda crazy.

Reminds me of the "just get Netflix, Prime, etc." ending up with a $100/m bill.

Re: Ghidra by NSA

#174

Post by carlcortright »

decidu0us9034 wrote: post #164
dakolli wrote: post #137

Everyone in the comments is like, "take a look at this AI tool for Ghirda" This is indicative of two things. 1. While I can't stand the guy, ya'll need to watch Peter Thiel's talk from 10-15 years ago at Stanford about not building the same thing everyone else is, a la, the obvious thing. 2. People are really attracted to using LLMs on deep thinking tasks, off shoring their thinking, to a "Think for me SaaS". This wo…

I was wondering why so many people were suddenly hopping into my humble profession and declaring me redundant. Ah, a youtube influencer is at the center of it. Makes sense.

lol

Re: Ghidra by NSA

#175

Post by godelski »

zmgsabst wrote: post #170
godelski wrote: post #165

Earlier quoted context omitted.

Interpret the intent of the parent's comment more and focus less on finding its critiques. The irony here is that the critique you made is the most obvious one, which also means it is the one that the parent believed you're most likely to understand the implicit context around. I don't think anyone has handed all thinking over to LLMs, it's always somewhere on a spectrum. I think we can assume the parent isn't framin…

I’ve made frameworks that turn a project entirely over to the AI — eg, turn a paragraph summary of what I want into a book on that topic. Obviously I get much less out of that — I’m not denying the tradeoff, just saying that some people are all the way to “write a short request, accept the result” for (certain) thinking tasks.

Sure but even that falls on the spectrum. The request requires some thinking. So if we're not being pedantic then people will criticize because natural language isn't

Re: Ghidra by NSA

#176

Post by wrboyce »

palata wrote: post #20

Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an experienced developer, but not so experienced in reverse engineering? I guess one issue I have is that I don't have good ideas of fun projects, and that's probably something I need to actually get the motivation to learn. I can find a "hello world", that's easy,…

Allow me to shamelessly plug my blog, I have been (very slowly!) re-visiting microcorruption and writing up the solutions in a tutorial-esque fashion.

https://lovesexsecretgod.com

Re: Ghidra by NSA

#177

Post by le-mark »

joe_mamba wrote: post #69
Alifatisk wrote: post #64

Earlier quoted context omitted.

There is MCPs for Ghidra

Yeah this. I saw some guys on youtube use AI MCPs to do some crazy reverse engineering. It's difficult to be an AI doomer when you see stuff like this.

“AI Doomer” is ambiguous here! Do you mean someone who optimistic about ai will never amount to anything, or that ai won’t be the end of humanity?

Re: Ghidra by NSA

#178

Post by evmar »

boricj wrote: post #136

Might as well plug in my own extension: https://github.com/boricj/ghidra-delinker-extension It's a relocatable object file exporter that supports x86/MIPS and ELF/COFF. In other words, it can delink any program selection and you can reuse the bits for various use-cases, including making new programs Mad Max -style. It carved itself a niche in the Windows decompilation community, used alongside objdiff or decomp.me.

Where can I learn more about the Windows decompilation community? (This is an area I kind of work in, and I am interested in participating!)

Re: Ghidra by NSA

#179

Post by tptacek »

dakolli wrote: post #137

Everyone in the comments is like, "take a look at this AI tool for Ghirda" This is indicative of two things. 1. While I can't stand the guy, ya'll need to watch Peter Thiel's talk from 10-15 years ago at Stanford about not building the same thing everyone else is, a la, the obvious thing. 2. People are really attracted to using LLMs on deep thinking tasks, off shoring their thinking, to a "Think for me SaaS". This wo…

In a funny inversion of the normal analogy to machine code and compilers, you could say the same thing about people using decompilation rather than getting gud at reading ARM assembly.

Re: Ghidra by NSA

#180

Post by burnt-resistor »

q3k wrote: post #25
yibers wrote: post #18

Can anyone provide their opinion of Ghidra vs Ida? Is Ida worth the extra money?

IDA is the better tool if you're being paid to work with architectures that IDA supports well (ARM(64), x86(_64), etc). This usually means 'mainstream' security/malware research. It's not worth the price for hobbyists. Before Hex-Rays was sold to private equity, it could make sense for rich hobbyists to pay for a private license once and use it for a few years without software updates, with the cloud offering now it…

Fuck private equity, e.g., rich vampiric assholes ruining everything.
Post reply on HN