Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra by NSA

github.com

Post reply on HN
Print view View original

181–190 of 231 posts

Re: Ghidra by NSA

#181

Post by cindyllm »

burnt-resistor wrote: post #180
q3k wrote: post #25

Earlier quoted context omitted.

IDA is the better tool if you're being paid to work with architectures that IDA supports well (ARM(64), x86(_64), etc). This usually means 'mainstream' security/malware research. It's not worth the price for hobbyists. Before Hex-Rays was sold to private equity, it could make sense for rich hobbyists to pay for a private license once and use it for a few years without software updates, with the cloud offering now it…

Fuck private equity, e.g., rich vampiric assholes ruining everything.

[dead]

Re: Ghidra by NSA

#182

Post by zmgsabst »

godelski wrote: post #175
zmgsabst wrote: post #170

Earlier quoted context omitted.

I’ve made frameworks that turn a project entirely over to the AI — eg, turn a paragraph summary of what I want into a book on that topic. Obviously I get much less out of that — I’m not denying the tradeoff, just saying that some people are all the way to “write a short request, accept the result” for (certain) thinking tasks.

Sure but even that falls on the spectrum. The request requires some thinking. So if we're not being pedantic then people will criticize because natural language isn't

I think it’s a difference in kind, ie, if we return to above[0] and the discussion about “outsourcing our thinking” — then it deeply depends on what we hope to accomplish. That’s what I was originally intending to convey: that people are actually inhabiting the space you used as an extreme because they’re operating in a different mode.

That is, we seem to be conflating different cases - ie, being an expert versus hiring an expert. A manager and an SDE get different utility from the LLM.

I think I expressed it poorly, but I think that we need to consider that outsourcing thinking entirely is the right answer in the way that subcontracting or outsourcing or hiring itself can be; and that we seem to get caught in a “spectrum” or false dichotomy (ie, “is outsourcing good or bad?”) discussion, when the actual utilization of LLMs, their content, etc interacts in a complex way due to the diversity of roles, needs, etc that humans themselves have. And the impact on acquired expertise is only one aspect, for which “less work, less learning” is both true but too simple.

[0] - https://news.ycombinator.com/item?id=47040091

Re: Ghidra by NSA

#183

Post by lauriewired »

dakolli wrote: post #137

Everyone in the comments is like, "take a look at this AI tool for Ghirda" This is indicative of two things. 1. While I can't stand the guy, ya'll need to watch Peter Thiel's talk from 10-15 years ago at Stanford about not building the same thing everyone else is, a la, the obvious thing. 2. People are really attracted to using LLMs on deep thinking tasks, off shoring their thinking, to a "Think for me SaaS". This wo…

This is correct. The majority of cases I have to rely on my own expertise.

It's useful for the automation of small repetitive tasks here and there. I was never expecting it to gain the traction that it did; anyone saying they expect it to replace reverse engineers (it won't) is wildly misunderstanding the original intent.

Quite trivial to create binaries that massively confuse LLMs!

Re: Ghidra by NSA

#185

Post by petterroea »

lauriewired wrote: post #183
dakolli wrote: post #137

Everyone in the comments is like, "take a look at this AI tool for Ghirda" This is indicative of two things. 1. While I can't stand the guy, ya'll need to watch Peter Thiel's talk from 10-15 years ago at Stanford about not building the same thing everyone else is, a la, the obvious thing. 2. People are really attracted to using LLMs on deep thinking tasks, off shoring their thinking, to a "Think for me SaaS". This wo…

This is correct. The majority of cases I have to rely on my own expertise. It's useful for the automation of small repetitive tasks here and there. I was never expecting it to gain the traction that it did; anyone saying they expect it to replace reverse engineers (it won't) is wildly misunderstanding the original intent. Quite trivial to create binaries that massively confuse LLMs!

I bet red herrings are effective

Re: Ghidra by NSA

#186

Post by sneak »

dakolli wrote: post #137

Everyone in the comments is like, "take a look at this AI tool for Ghirda" This is indicative of two things. 1. While I can't stand the guy, ya'll need to watch Peter Thiel's talk from 10-15 years ago at Stanford about not building the same thing everyone else is, a la, the obvious thing. 2. People are really attracted to using LLMs on deep thinking tasks, off shoring their thinking, to a "Think for me SaaS". This wo…

> People are really attracted to using LLMs on deep thinking tasks, off shoring their thinking, to a "Think for me SaaS". This won't end well for you, there's no shortcuts in life that don't come with a (huge) cost.

I, too, watched The Sorcerer’s Apprentice. The problem is that I, too, shipped a fuckton of working, reviewed, reworked, tests-and-lint-passing, properly-typed code implementing brand new features from scratch in the last 48 hours, that would have taken me 48 days a year ago.

“thinking” means a lot of different things, and you can indeed outsource a lot of it to other things that can think at different levels of ability than you. This is effectively what an engineering organization does.

Perhaps I haven’t fully offshored my thinking in the sense you mean in that I review all the code and give feedback on the PRs—I still steer. But I think the SOTA will continue to improve until we can indeed oneshot larger and larger tasks.

Re: Ghidra by NSA

#187

Post by butvacuum »

petterroea wrote: post #185
lauriewired wrote: post #183

Earlier quoted context omitted.

This is correct. The majority of cases I have to rely on my own expertise. It's useful for the automation of small repetitive tasks here and there. I was never expecting it to gain the traction that it did; anyone saying they expect it to replace reverse engineers (it won't) is wildly misunderstanding the original intent. Quite trivial to create binaries that massively confuse LLMs!

I bet red herrings are effective

I wonder if renaming variables to all reference a single movie or book (go through the exe and rename each new variable to the next word or letter in Monty Python's Holy Grail) would do anything.

Re: Ghidra by NSA

#188

Post by dakolli »

sneak wrote: post #186
dakolli wrote: post #137

Everyone in the comments is like, "take a look at this AI tool for Ghirda" This is indicative of two things. 1. While I can't stand the guy, ya'll need to watch Peter Thiel's talk from 10-15 years ago at Stanford about not building the same thing everyone else is, a la, the obvious thing. 2. People are really attracted to using LLMs on deep thinking tasks, off shoring their thinking, to a "Think for me SaaS". This wo…

> People are really attracted to using LLMs on deep thinking tasks, off shoring their thinking, to a "Think for me SaaS". This won't end well for you, there's no shortcuts in life that don't come with a (huge) cost. I, too, watched The Sorcerer’s Apprentice. The problem is that I, too, shipped a fuckton of working, reviewed, reworked, tests-and-lint-passing, properly-typed code implementing brand new features from sc…

I actually have zero clue what Sorcerer's apprentice is, or what you're getting at. I never said that it isn't useful for dumb tedious tasks that don't require much thought.

I was talking about critical tasks where human nuance is important, just because an LLM can produce a result, does not mean that the result is great. Not everything people work on are "features" delivered via http handlers.

I don't understand this new paradigm where everyone wants to brag about how quick they get X amount of work done. Its the long standing belief of pretty much any quality builder that quick != quality, and quick usually isn't necessary. I'm glad your KPIs are great though and your product is getting 2 months of features every two days... The world needs this!

Re: Ghidra by NSA

#189

Post by userbinator »

flipped wrote: post #35
yibers wrote: post #18

Can anyone provide their opinion of Ghidra vs Ida? Is Ida worth the extra money?

Almost every hobbyist reverse engineer uses cracked IDA which is easily available. I have never seen ghidra being recommended for serious work.

Cracking IDA yourself was, and maybe still is, a "rite of passage" in certain communities.

Re: Ghidra by NSA

#190

Post by userbinator »

yibers wrote: post #18

Can anyone provide their opinion of Ghidra vs Ida? Is Ida worth the extra money?

One huge difference is that IDA is much faster and less resource-intensive than Ghidra, on account of the latter being written in Java (not surprisingly) while the former is native code. The Ghidra UI is noticeably laggy to perform basic operations even with tiny binaries, while I haven't noticed anything like that in IDA.
Post reply on HN