Download: https://ghidra-sre.org/ GitHub: https://github.com/NationalSecurityAgency/ghidra
Is this available outside the US? the first link returns a 403, the second contains no code... ?
Ghidra, NSA's reverse-engineering tool
271–280 of 425 posts
Re: Ghidra, NSA's reverse-engineering tool
#272Earlier quoted context omitted.
Malware analysis and vulnerability research.
Would you mind answering some questions if you're familiar with the area (edit: hah, just noticed you posted to the OP to this whole thread.); What are some examples of firms that are involved in this work? Is it mostly a collection of smaller shops/individual contractors? After a cursory search, I seem to be seeing a lot of groups/labs comprised of relatively few people. Why are there so many references to high bill…
My office is in the same building as BitDefender. I casually talked to some of the guys and they do use IDA Pro in their malware research department.
They mostly hire their researchers straight out of college if they have high C proficiency and train them internally to use IDA Pro.
I know my comment isn't exactly what you asked, but I hope it clears some light.
Re: Ghidra, NSA's reverse-engineering tool
#273Earlier quoted context omitted.
For the lazy: > Restrictions. Subject to applicable copyright, trade secret and other laws, you are permitted under this License to reverse engineer or de-compile the Software but you may not alter, duplicate, modify, rent, lease, loan, sublicense, create derivative works from or provide others with the Software in whole or part, or transmit or communicate any of the Software over a network in order to share it with…
> create derivative works from That's pretty much the only reason one would reverse engineer it, in this context - and it's somewhat misleading to suggest otherwise.
Most reverse engineering done nowadays is not for derivative works
Re: Ghidra, NSA's reverse-engineering tool
#274This is Sanskrit name for Vulture Ghid = Vulture Ra = In Sanskrit RA is the acoustic root of fire. RA also connotes with light or spiritual light.
No. This is clear apophenia. Ghidra is a reference to the Japanese video game boss of the same name, which was supposed to be called Hydra, but due to mis-translation, came as Ghidra
In Sanskrit, a vulture is vocally spoken aloud like [Giddh], emphasis on the end.
> Ra is the acoustic root of fire
Any source for that?
Re: Ghidra, NSA's reverse-engineering tool
#275Earlier quoted context omitted.
I think you're underestimating the value of intel on people who know how to get intel or at least interested in the topic.
It's part of the NSA's recruiting push. "If you are interested in projects like this ... consider applying" is even mentioned in the README. There's zero chance there's some secret trojan, because the people who are interested in this type of software are the exact people who would be able to find it.
Well... I suppose you could argue that it would make sense for them to add a secret trojan, encrypted alongside a message along the lines of "we'd like to talk to you about an interesting employment offer, give us a call on 00000" ;)
Re: Ghidra, NSA's reverse-engineering tool
#276Just used it to solve the 2015 flare-on challenge #1. Rudimentary, but I am blown away. The interface feels better than IDA, I was able to write a python script straight away! 10/10 recommended.
The python interpreter attached with it is aware of the state. Where is my cursor, what memory module I have selected etc. Easy to write scripts for
Re: Ghidra, NSA's reverse-engineering tool
#277Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…
Wait, IDA has a collaborative mode? I couldn't find one; link please? This is shocking, because, in an E-mail exchange a few years ago, Ilfak wrote to me: > [...] we at hex-rays do not have any ideas how to implement dynamic database synchronization, so it is unlikely that others will come up with a good solution.
Re: Ghidra, NSA's reverse-engineering tool
#278Earlier quoted context omitted.
> All software should be free, The marginal cost of one more user is exactly zero All bridges should be free, The marginal cost of one more user is effectively zero.
If you're suggesting we should fund critical software in the same way that we fund bridges, then I support that motion.
Quite ironically for the GP, that's exactly what has happened in this case: a taxpayer-funded governmental organisation (NSA) has produced and released a public good for free consumption. They literally saw the toll bridge (IDA Pro), said ‘nope’ for whatever internal reason, built a new one downstream, drove their vehicles across it, and then said “hey folks, this over here is for you to use for free whenever you want”.
Re: Ghidra, NSA's reverse-engineering tool
#279Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…
>is basically the first real competitor to IDA Pro
What do you think of BAP[1]?
Re: Ghidra, NSA's reverse-engineering tool
#280mother of zeus