Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra by NSA

github.com

Post reply on HN
Print view View original

21–30 of 231 posts

Re: Ghidra by NSA

#21

Post by sergent_moon »

19h wrote: post #12
bjackman wrote: post #8

Earlier quoted context omitted.

Very likely people who actually work on RE at the NSA also have access to IDA Pro licenses. I don't work in this space, so take it with a pinch of salt, but my understanding is this is a fairly long term strategic initiative to _eventually_ be the best tool.

Ghidra has a slightly different focus than IDA, so they're definitely not just using Ghidra :-)

I have only a very basic understanding of the two tools. Can you give me just some highlights regarding their differences?

Re: Ghidra by NSA

#22

Post by mickeyp »

mdavid626 wrote: post #13

Works well. I used this tool once to disassemble and understand how key manager works on Vivotek cameras. They create executables, which contain encrypted binary data. Then, when the executable runs, it decodes the encrypted data and pipes it into "sh". The security is delusional here - the password is hard coded in the executable. It was something like "VIVOTEK Inc.". Ghidra was able to create the C code and I was a…

Sounds like `strings' on the binary would've sufficed if it's just hardcoded.

Re: Ghidra by NSA

#23

Post by gray_charger »

palata wrote: post #20

Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an experienced developer, but not so experienced in reverse engineering? I guess one issue I have is that I don't have good ideas of fun projects, and that's probably something I need to actually get the motivation to learn. I can find a "hello world", that's easy,…

You can start here to learn reverse engineering.

https://beginners.re/

Re: Ghidra by NSA

#24

Post by bibelo »

cactusplant7374 wrote: post #14
atemerev wrote: post #4

I always wondered whether they have a much more capable internal version. And I wonder the same thing for AI labs (they have to do a lot of lobotomy for their models to be ready for public use... but internally, they can just skip this perhaps?)

The gains come from pairing Ghidra with a coding agent. It works amazing well.

would you have a tutorial on that?

Re: Ghidra by NSA

#25

Post by q3k »

yibers wrote: post #18

Can anyone provide their opinion of Ghidra vs Ida? Is Ida worth the extra money?

IDA is the better tool if you're being paid to work with architectures that IDA supports well (ARM(64), x86(_64), etc). This usually means 'mainstream' security/malware research. It's not worth the price for hobbyists. Before Hex-Rays was sold to private equity, it could make sense for rich hobbyists to pay for a private license once and use it for a few years without software updates, with the cloud offering now it pretty much makes no sense.

Ghidra is the better tool if you're dealing with exotic architectures, even ones that you need to implement support for yourself. That's because any architecture that you have a full SLEIGH definition for will get decompilation output for free. It might not be the best decompiler out there, sure, but for some architectures it's the only decompiler available.

Both are generally shit UX wise and take time to learn. I've mostly switched from IDA to Ghidra a while back which felt like pulling teeth. Now when I sometimes go back to IDA it feels like pulling teeth.

Re: Ghidra by NSA

#26

Post by 0x54MUR41 »

palata wrote: post #20

Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an experienced developer, but not so experienced in reverse engineering? I guess one issue I have is that I don't have good ideas of fun projects, and that's probably something I need to actually get the motivation to learn. I can find a "hello world", that's easy,…

If you are into the book, I would recommend The Ghidra Book from No Starch publisher https://nostarch.com/ghidra-book-2e.

The book is designed for beginner and advance users.

Re: Ghidra by NSA

#27

Post by 19h »

sergent_moon wrote: post #21
19h wrote: post #12

Earlier quoted context omitted.

Ghidra has a slightly different focus than IDA, so they're definitely not just using Ghidra :-)

I have only a very basic understanding of the two tools. Can you give me just some highlights regarding their differences?

Well, Ghidra's strength is batch processing at scale (which is why P-Code is less accurate than IDA's but still good enough) while allowing a massive amount of modules to execute. That allows huge distributed fleets of Ghidra. IDA has idalib now, and hcli will soon allow batch fleets, but IDA's focus is very much highly accurate analysis (for now), which makes it a lot less scalable performance wise (for now).

Re: Ghidra by NSA

#28

Post by 19h »

q3k wrote: post #25
yibers wrote: post #18

Can anyone provide their opinion of Ghidra vs Ida? Is Ida worth the extra money?

IDA is the better tool if you're being paid to work with architectures that IDA supports well (ARM(64), x86(_64), etc). This usually means 'mainstream' security/malware research. It's not worth the price for hobbyists. Before Hex-Rays was sold to private equity, it could make sense for rich hobbyists to pay for a private license once and use it for a few years without software updates, with the cloud offering now it…

Which exotic architectures is IDA missing from your perspective?

Re: Ghidra by NSA

#29

Post by quux0r »

palata wrote: post #20

Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an experienced developer, but not so experienced in reverse engineering? I guess one issue I have is that I don't have good ideas of fun projects, and that's probably something I need to actually get the motivation to learn. I can find a "hello world", that's easy,…

So a couple things. Bruce Dang’s book, while a little old, is still a great spot to get started. Another great book is Blue Fox by Maria Markstedter for ARM. From there, finding small binaries and just trying to get the “flow” is a good next step, for me this is largely renaming functions and variables and essentially trying to work the decompiled code into something readable, then you can find flaws.

So for the second thing, pulling the data off chips like that typically involves some specialized hardware, and you have to potentially deal with a bunch of cryptographic safeguards to read from the chip’s memory. Not impossible though, and there are not always good safeguards, but might be worth checking out some simpler programs and working up to it, or learning some basic hardware hacking to get an idea of how that process works.

Re: Ghidra by NSA

#30

Post by flipped »

zeon256 wrote: post #6

Been awhile since I used this but decided to open the latest version to check my rust binary and was pleasantly surprised how much better it is today wrt rust binaries

Can you be more specific? Is it getting easier to reverse rust and go, since I have read about it being the hardest to reverse.
Post reply on HN