Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

231–240 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#231

Post by praptak »

stevefan1999 wrote: post #220
tptacek wrote: post #57

Earlier quoted context omitted.

It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…

Yes. In fact, the essence of decompilation is a NP-Complete problem: Graph Isomorphism. So far, our decompilers are just greedy scheme to approximate the original expressions as best as possible by treating each instruction as a tree then as a graph, but still even a single assignment could cause the entire outcome of the code to change a lot, let alone to correctly recognizing heavily optimized procedures. Edit: Wik…

Graph Isomorphism is not known to be NP-hard, that is we don't know a proof that a polynomial algorithm for GI implies NP=P. So it is "at most NP" rather than "at least NP", because GI is obviously in NP.

Re: Ghidra, NSA's reverse-engineering tool

#232

Post by perlgeek »

thornjm wrote: post #172
zelon88 wrote: post #125

I'm curious what feature specifically prompted the NSA to develop their own IDA Pro alternative. I mean, someone somewhere at the NSA must have been trying to do something with IDA Pro only to repeatedly fail before the decision was made that whatever the NSA was trying to do warranted developing their own IDA Pro... right? Or perhaps they used IDA Pro so often and grew so frustrated by it that they started their own…

A few reasons I can think of: 1. Collaborative. 2. supporting classified proprietary architectures (think missile chips or something) 3. The intermediate representation (architecture independent representation of code) can be integrated in to many other classified tools. Maybe for automated analysis for example.

4. Managing licenses is a huge PITA, presumably especially in environments with lots of classified information.

Re: Ghidra, NSA's reverse-engineering tool

#233

Post by Brotkrumen »

dman wrote: post #199
justinjlynn wrote: post #132

Earlier quoted context omitted.

It's not Open Source.

If you have any pointers to a company / individual making a living building open source tools for developers please let me know. (Working for a large cloud / OS provider that is subsidizing tool development as part of a platform play does not count).

>subsidizing tool development as part of a platform play does not count

So you're excluding deploying/maintaining Open Source Software as a service. That basically excludes how Open Source is supposed to get monetized.

Re: Ghidra, NSA's reverse-engineering tool

#234

Post by neckardt »

bencoder wrote: post #224
lowpro wrote: post #209

Earlier quoted context omitted.

If your Red team is reversing binaries you’re doing it wrong.

Why? If your real world adversaries can reverse binaries, why would you shackle a Red team from doing so?

Because they have access to the source code itself. No need to reverse engineer anything.

Re: Ghidra, NSA's reverse-engineering tool

#235

Post by Fnoord »

supermw wrote: post #173
vageli wrote: post #127

Earlier quoted context omitted.

> If this is expensive to you, then it’s not for you. This is for people who are making real money with these tools, not hobbyists dicking around. That's an odd perspective. Imagine if this type of sentiment were applied to paint brushes. There is a lot of useful work that is not economically viable per se, and to discount that and to be pejorative feels wrong.

If you are using these tools you are either defending systems from threats or breaking into systems and making money through illegal activities. There is not really any other useful work you can do with these tools. I don’t see how the perspective is odd. Having tools like Core Impact and the knowledge of how to use them well can propel you to a six figure income easily. On top of that these tools are also business e…

If you are studying to become a (paid) professional in the field, be it offensive or defensive, having a quality, open source, free tool available which is also the defacto standard is a big plus for getting you started. Elitist will fear such competition, those with love for the field of work will endorse it.

Re: Ghidra, NSA's reverse-engineering tool

#236

Post by bluesign »

bencoder wrote: post #224
lowpro wrote: post #209

Earlier quoted context omitted.

If your Red team is reversing binaries you’re doing it wrong.

Why? If your real world adversaries can reverse binaries, why would you shackle a Red team from doing so?

Because they should use the source.

Re: Ghidra, NSA's reverse-engineering tool

#237

Post by Darmani »

emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

Wait, IDA has a collaborative mode? I couldn't find one; link please?

This is shocking, because, in an E-mail exchange a few years ago, Ilfak wrote to me:

> [...] we at hex-rays do not have any ideas how to implement dynamic database synchronization, so it is unlikely that others will come up with a good solution.

Re: Ghidra, NSA's reverse-engineering tool

#238

Post by justinjlynn »

elliotec wrote: post #201
legitbs_ctf wrote: post #187

Earlier quoted context omitted.

That’s actually untrue - they explicitly give permission to reverse engineer their software in the license. Check restrictions in https://docs.binary.ninja/about/license/index.html

For the lazy: > Restrictions. Subject to applicable copyright, trade secret and other laws, you are permitted under this License to reverse engineer or de-compile the Software but you may not alter, duplicate, modify, rent, lease, loan, sublicense, create derivative works from or provide others with the Software in whole or part, or transmit or communicate any of the Software over a network in order to share it with…

> create derivative works from

That's pretty much the only reason one would reverse engineer it, in this context - and it's somewhat misleading to suggest otherwise.

Re: Ghidra, NSA's reverse-engineering tool

#239

Post by nneonneo »

dman wrote: post #38
emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.

Being open-sourced is a big advantage. I just fixed a bug in GHIDRA relating to trackpad scrolling which makes it MUCH more usable for me. I could never do the same with IDA or Binary Ninja.

I do so love the shell code compiler of Binary Ninja, though. It works very well and has definitely saved me a lot of time.

Re: Ghidra, NSA's reverse-engineering tool

#240

Post by justinjlynn »

smokeyj wrote: post #149
tptacek wrote: post #140

Earlier quoted context omitted.

Another way to think about it is that if any piece of professional software should cost a lot, a super-specialized piece of software that is hard to duplicate, is a near industry standard, and is used almost exclusively by people with high bill rates should be expensive. But again, my point is: IDA costs a lot less than its place in the market suggests it should. I'm not arguing that a capable free alternative is a b…

> But again, my point is: IDA costs a lot less than its place in the market suggests it should. Sounds like every developer working on an open source stack.

Well, now the market is saying that such a tool should be open sourced and well, now it is.
Post reply on HN