Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ghidra, NSA's reverse-engineering tool

nsa.gov

Post reply on HN
Print view View original

351–360 of 425 posts

Re: Ghidra, NSA's reverse-engineering tool

#351

Post by auiya »

in_hindsight wrote: post #169
yifanlu wrote: post #66

From someone who does binary reverse engineering full time, in my experience, BinaryNinja, Hopper, radare2, etc are toys compared to IDA Pro + Hex Rays Decompiler. The quality of the results and the features supported are unmatched... until now. I haven’t spent too much time with ghidra yet but it’s the real deal. The output of the decompiler looks alright (not complete garbage like I’ve seen with other tools). Even…

Out of curiosity what kind of job involves doing binary reverse engineering full time?

Chinese software dev firms.

Re: Ghidra, NSA's reverse-engineering tool

#352

Post by smolsky »

emidoots wrote: post #30

Why this is important (for those uninitiated): - Ghidra is basically the first real competitor to IDA Pro, the extremely expensive and often pirated state-of-the-art software for reverse engineering. Nothing else has come close to IDA Pro. - Ghidra is open-source, IDA Pro is not. - Ghidra has a lot of really cool features that IDA Pro doesn't, such as decompiling binaries to pseudo-C code. - It's also collaborative,…

Let's not forget https://www.radare.org which is trying to be a OSS IDA Pro.

Re: Ghidra, NSA's reverse-engineering tool

#353

Post by psifertex »

jjoonathan wrote: post #158
dman wrote: post #38

Earlier quoted context omitted.

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.

And they didn't take my money, break my key in an update, and ghost me while I was still in the support period. So they've got that going for them.

I'm sorry you had a bad experience. This is the first I've heard about it! We normally get nothing but praise during any customer support interaction. Feel free to email me directly (jordan at vector35 com) with your email address so I can try to figure out what happened. Apologies it didn't go well.

Re: Ghidra, NSA's reverse-engineering tool

#355

Post by psifertex »

jjoonathan wrote: post #340
philpem wrote: post #327

Earlier quoted context omitted.

Did they ever tell you why they did that? I'd like to hear the rest of this story, I was considering buying IDA Pro (though these days I'm having a lot of fun adding M68k support to Avast's Retdec)

No, they never replied at all. Their self-service site broke and they completely and utterly ignored my emails to the associated service address and to a number of other addresses posted on their site. I grew up using, ah, other methods of satisfying my need for an interactive debugger and those methods continued to be viable after giving hex-rays $1100 and getting flaked, so I wasn't materially impacted by the flake…

This is really strange to hear. What self service site did you use? Our website chat goes right to a slack channel that multiple folks monitor and reply to at all hours of the day. Worst case if we're all sleeping and you leave an email we respond when we're awake.

Just searched for your username in our chat and our email and don't see anything so I assume you've got a different email?

Re: Ghidra, NSA's reverse-engineering tool

#356

Post by lowpro »

bencoder wrote: post #224
lowpro wrote: post #209

Earlier quoted context omitted.

If your Red team is reversing binaries you’re doing it wrong.

Why? If your real world adversaries can reverse binaries, why would you shackle a Red team from doing so?

Because although you don't have source code (like other commenters are saying), reversing a program to get into a company would be the hardest way to go. Red teams are used to test a company's overall security, and reversing normally wouldn't make sense compared to phishing, using common exploits, and owning the network. Reversing binaries is not the job of a red team, but pentesters of specific systems.

Re: Ghidra, NSA's reverse-engineering tool

#357

Post by tptacek »

alexozer wrote: post #345
tptacek wrote: post #138

Earlier quoted context omitted.

Retdec is based in part on Capstone, like Hopper.

I believe Capstone is merely a disassembly framework, and retdec's decompilation process is custom implementation which works on LLVM IR.

Yeah, sorry, as I understand it, it uses Capstone as the disassembler and implements an LLVM lifter over it. It was pretty dumb to describe it as "based on Capstone"; I was just mentally breaking tools down by which CFG recovery system it relied on.

Re: Ghidra, NSA's reverse-engineering tool

#358

Post by maerF0x0 »

psifertex wrote: post #353
jjoonathan wrote: post #158

Earlier quoted context omitted.

And they didn't take my money, break my key in an update, and ghost me while I was still in the support period. So they've got that going for them.

I'm sorry you had a bad experience. This is the first I've heard about it! We normally get nothing but praise during any customer support interaction. Feel free to email me directly (jordan at vector35 com) with your email address so I can try to figure out what happened. Apologies it didn't go well.

I think parent was saying that Binary Ninja _didnt_ do those things (implying that IDA did).

Re: Ghidra, NSA's reverse-engineering tool

#359

Post by psifertex »

jjoonathan wrote: post #158
dman wrote: post #38

Earlier quoted context omitted.

Think BinaryNinja has been acting pretty effectively as a competitor to IDA Pro. Its much cheaper than IDA, has a good API and I have been a very happy customer.

And they didn't take my money, break my key in an update, and ghost me while I was still in the support period. So they've got that going for them.

Oh also, just to clarify -- are you talking about Binary Ninja or something else? That would explain a lot of my confusion. :-P

Re: Ghidra, NSA's reverse-engineering tool

#360

Post by BuildTheRobots »

BuildTheRobots wrote: post #346
reitanqild wrote: post #266

Earlier quoted context omitted.

Hunting for bugs to report would be a valid, wouldn't it?

Not if you're oracle.

Can't edit but I'll reply: This was meant as more than a throwaway comment, please see the many discussions - Oracle's chief security officer got extremely upset by it.

https://www.zdnet.com/article/oracle-to-sinner-customers-rev...

https://news.ycombinator.com/item?id=10043432

Post reply on HN