Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

181–190 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#181

Post by gruez »

pcwalton wrote: post #164
tptacek wrote: post #140

Earlier quoted context omitted.

Another way to think about it is that if any piece of professional software should cost a lot, a super-specialized piece of software that is hard to duplicate, is a near industry standard, and is used almost exclusively by people with high bill rates should be expensive. But again, my point is: IDA costs a lot less than its place in the market suggests it should. I'm not arguing that a capable free alternative is a b…

> I think there's an industry business case study in what Hex-Rays could have done to keep this from happening, though. Is the fact that Hex-Rays is Russian one of the reasons why Ghidra exists? (Honest question.) If so, is there anything they could have done differently?

AFAIK the author is Russian but lives in Belgium

Re: Ghidra, NSA's reverse-engineering tool

#182

Post by Wowfunhappy »

nordsieck wrote: post #144
TheSoftwareGuy wrote: post #118

Earlier quoted context omitted.

All software should be free, The marginal cost of one more user is exactly zero

> All software should be free, The marginal cost of one more user is exactly zero All bridges should be free, The marginal cost of one more user is effectively zero.

While I agree with your overall point, this isn't the greatest analogy, because a finite number of users are able to use a bridge simultaneously. A bridge with too many users is called a traffic jam.

Re: Ghidra, NSA's reverse-engineering tool

#183

Post by omeid2 »

strictnein wrote: post #110
omeid2 wrote: post #50

Earlier quoted context omitted.

I think you're underestimating the value of intel on people who know how to get intel or at least interested in the topic.

It's part of the NSA's recruiting push. "If you are interested in projects like this ... consider applying" is even mentioned in the README. There's zero chance there's some secret trojan, because the people who are interested in this type of software are the exact people who would be able to find it.

It doesn't have to be a secret trojan. Just a trojan is good enough.

Re: Ghidra, NSA's reverse-engineering tool

#185

Post by pvg »

kbenson wrote: post #136
tptacek wrote: post #57

Earlier quoted context omitted.

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

> It's a funny situation, though: decompilation probably should cost a small fortune. In the past, the same could have been said of compilers and even web server and mail server software. > many [most?] fields where people routinely decompile stuff are very highly compensated. If it's more freely available, and more people have experience with it, then the compensation might go down as the supply of people with this…

In the past, the same could have been said of compilers and even web server and mail server software.

I'm not sure the exact same thing could have been said which to me seems like a testament to how complicated software pricing can be. Web servers never really sold†, platform vendors eventually figured out it's better for them for compilers to be free (non-platform vendors still sell compilers), etc.

† back in the 90s, Netscape used to pester web companies to make their Apache installs lie that they are Netscape web servers.

Re: Ghidra, NSA's reverse-engineering tool

#186

Post by paxys »

xxpor wrote: post #131

Why do they have a LICENCE file with the Apache Licence in it? As a work of the federal government this is public domain by definition, isn't it? edit: Oh, outside contributors of course retain their own copyright. That's what's licenced. https://github.com/NationalSecurityAgency/ghidra/blob/master...

They can also enforce copyright in other countries.

Re: Ghidra, NSA's reverse-engineering tool

#187

Post by legitbs_ctf »

justinjlynn wrote: post #163
idlewords wrote: post #150

Earlier quoted context omitted.

You can just reverse-engineer it!

No, you almost certainly promised not to do so when you bought a licence.

That’s actually untrue - they explicitly give permission to reverse engineer their software in the license.

Check restrictions in https://docs.binary.ninja/about/license/index.html

Re: Ghidra, NSA's reverse-engineering tool

#188

Post by bpye »

yifanlu wrote: post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

I've found radare2 pretty neat for doing some automated analysis (specifically on RISC-V binaries), but I agree, IDA Pro has, until now at least, been the undisputed champion.

Re: Ghidra, NSA's reverse-engineering tool

#189

Post by bpye »

in_hindsight wrote: post #169
yifanlu wrote: post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

Out of curiosity what kind of job involves doing binary reverse engineering full time?

Red team?

Re: Ghidra, NSA's reverse-engineering tool

#190

Post by tptacek »

xvector wrote: post #159
jchw wrote: post #100

Earlier quoted context omitted.

My personal reason for not pirating IDA Pro is because I don't want to contribute to the problem. It's one thing to argue about the effects of piracy on things like video games, where the unit price is much cheaper, and a large number of users are casual users who mostly are going to buy legitimate copies if it's convenient and not exorbitantly expensive. Power user software, like Photoshop, IDA Pro, VMWare, etc. are…

> yet I have no doubt an enormous amount of their poweruser userbase simply have never paid for them. Do keep in mind that many of these companies expect users to pirate their software. Indeed, piracy is ironically part of what has made Adobe such a big player - teenagers pirating software in highschool, and using it up until their first job, make it their go-to tool when they actually do enter a company. Often leavi…

Hex-Rays is not one of those companies, I don't think.
Post reply on HN