Earlier quoted context omitted.
Any chance you could do a few videos tutorials on using it in conjunction with Python?
That's a great idea!! I can try.
Remind me! 7 days.
Shit... wrong site.
Ghidra, NSA's reverse-engineering tool
411–420 of 425 posts
Re: Ghidra, NSA's reverse-engineering tool
#412Earlier quoted context omitted.
And they didn't take my money, break my key in an update, and ghost me while I was still in the support period. So they've got that going for them.
I'm sorry you had a bad experience. This is the first I've heard about it! We normally get nothing but praise during any customer support interaction. Feel free to email me directly (jordan at vector35 com) with your email address so I can try to figure out what happened. Apologies it didn't go well.
Email privately and get noted for life. This is really annoying when some one complains publicly and they ask your to email in private. Why don't you go through the old emails and provide a solution.
Re: Ghidra, NSA's reverse-engineering tool
#413Earlier quoted context omitted.
Wrong answer. Selling support means that the developer is incentivized to make product unnecessarily complex. Also, with recent developments it turns out that other entities might be better at providing support than original developers, taking away the option to monetize OSS. Why bother writing your own software, when you can just sell services and provide support for a different one? Note that RedHat, often quoted a…
There's a lot more going on than just incentives to make a product "unnecessarily complex". It's certainly a concern but many companies make it work. I judge this an acceptable answer, not a wrong answer.
> It's certainly a concern but many companies make it work.
They do? Maybe. But they are walking a thin line between their short term (make it complex so we can, you know, sell support) and long term (make it simple enough that people don't jump ship) commercial interests. This is the reason I call it "unnecessarily" complex - it is in the interest of companies who sell support services that the product is not as easy to use as it could be.
Do we really need this? I think not, and I actually prefer what Redis Labs, MariaDB and others have been doing with the licenses for their modules. Sure, Business Source license and similar are not open-source (as in "freedom to take the product you have built and sell services on top of it, driving you out of similar business as collateral damage"), but at least they provide developers with the incentive to produce easy to use software, and not just because they feel like it, but because they can actually earn their living from it.
There might be some exceptions that "make it work", but this is in spite of just selling services on top of their product, not because of it. The cards are stacked against them - it is much easier (and profitable) to take other persons' product and build on it that it is to build your own.
In my experience, selling support is an acceptable answer only in the eyes of would-be competitors. Otherwise it is just plain wrong.
Re: Ghidra, NSA's reverse-engineering tool
#414Earlier quoted context omitted.
Wrong answer. Selling support means that the developer is incentivized to make product unnecessarily complex. Also, with recent developments it turns out that other entities might be better at providing support than original developers, taking away the option to monetize OSS. Why bother writing your own software, when you can just sell services and provide support for a different one? Note that RedHat, often quoted a…
I don't see this as an incentive specific to FOSS. Most customers of any software tend to demand increasingly complex featuresets as time goes on.
The complexity is not specific to FOSS. The incentive as described however is.
Re: Ghidra, NSA's reverse-engineering tool
#415Earlier quoted context omitted.
Hex-Rays can be hard to deal with, and the IC deals pretty extensively with large federal contractors like Raytheon, so it's possible they just needed something as capable as IDA that they could roll out across all their suppliers to use as a common toolchain and interchange format. But it's also possible this is just sort of a labor of love type thing.
There’s a third possibility: they wanted a piece of software they could customize to meet their needs. Admittedly, for simple bugfixes and the like, Hex-Rays’ support is known for being quite responsive (as suits the small number of customers). There’s also a quite large (albeit poorly-documented and crash-prone) SDK, which can handle a wide variety of needs and has gained functionality over time. But if you want to…
It's worth to note NSA has quite specific needs.
If you need some very specific small functionality by next monday for $1million, then that development can be arranged.
However, NSA could also reasonably want that their targets (who have extensive capabilities of their own, likely including insiders in various companies) can't find out that NSA needs that very specific small functionality by next monday. They may not care if that functionality becomes available to the general public sometime in the next year (preferably in a more general manner that covers the reasonable/common usecases instead of just the one NSA had at the moment), but leaking the information that you needed (and thus probably used) X at time Y often isn't acceptable.
At the very least, they'd need every single employee who works on that feature or can see that this feature was developed to be vetted by them i.e. to have a security clearance; and that also requires the company to have the appropriate processes and infrastructure for separate, secret codebases and builds that can't be seen by uncleared people. And that is something many companies can't or don't want to provide.
Re: Ghidra, NSA's reverse-engineering tool
#416Earlier quoted context omitted.
It's a funny situation, though: decompilation probably should cost a small fortune. If you're in a line of work that needs it, the quality of your decompiler is probably a huge factor in how valuable an hour of your time is, and many [most?] fields where people routinely decompile stuff are very highly compensated. IDA has always had a weirdly low price point given the bill rates of people who use it, and it's intere…
The pricing of Ida Pro is set to limit the size of the support work and to avoid liabilities. Do not know how it works now, but many years ago, as you were buying Ida Pro, they were asking questions and if anything seemed to imply that you want to hide the buyer's identity, they refused to sell. That is, Hex-Rays do not want to have any business relationship with the proverbial would-be teenage hackers. Outside of th…
It still works like that. I practically had to beg Hex Rays to take my money. They were very skeptical of me at initial purchase, it took about 2 hours of email exchange and phone calls.
When I went to renew my support, they grilled me again. This was just a few weeks ago. I gave up and figured Ghidra was just around the corner. Looking forward to trying it.
I emailed them and told them a) I didn't appreciate being treated like a criminal (won't get into the specifics, but one set of answers led to another set of questions, but I'm a consultant with my own company, website, physical address, company history, blog posts, etc. -- I work in security / reverse engineering of electronic devices)
I also told them I've never had to work so hard to give someone my money. Finally I gave up. Let the market speak.
Re: Ghidra, NSA's reverse-engineering tool
#417Earlier quoted context omitted.
Why? If your real world adversaries can reverse binaries, why would you shackle a Red team from doing so?
Because although you don't have source code (like other commenters are saying), reversing a program to get into a company would be the hardest way to go. Red teams are used to test a company's overall security, and reversing normally wouldn't make sense compared to phishing, using common exploits, and owning the network. Reversing binaries is not the job of a red team, but pentesters of specific systems.
Red teaming isn't limited to "get into a company" testing of networks, it's also used for testing products and infrastructure that's outside the company. For example, you can reasonably have a red team evaluation of some authentication or payment infrastructure based on smartcards or mobile apps, and that'd inevitably include reverse engineering of all the artifacts that are available to the users; and in such cases also likely that many/most software parts of "your" product or device aren't made by you but redistributed from some other vendor, and you don't necessarily have the source available for that.
Re: Ghidra, NSA's reverse-engineering tool
#418Earlier quoted context omitted.
To be fair, I don't think HexRays is oblivious to this dynamic, and to that end I think the freeware version they offer makes a lot of sense. Especially if it supports AMD64, which I'm hearing it does nowadays. That's not going to prevent many people from taking the five finger discount I'm sure, since they'd rather have as many of the features as they can, but at least nobody can say HexRays isn't trying.
Yeah, but I think the big issue is the lack of decompiler. If you're new to RE, it's literally night and day between that and "assembly with stack variables renamed and some helpful comments". (Even Binja's MLIL is a huge step up from the annotated assembly IDA provides.)
Biggest limitation in the free version for me, as somebody who likes to tinker with old games as a pastime, is that it does not support any other instruction set than x86/x64 and not many executable formats either.
There are a lot of good and interesting games that were made in the DOS era for PCs which used the DOS4GW DOS extender, and their binaries come in the OS/2 executable format (LE/LX) which is unsupported in IDA's free version. A lot of good and interesting games also happen to run on game consoles which use non-x86 processors.
Ghidra probably won't have plugins to support all of these weird old legacy formats and CPUs which the full IDA package does for a while, but hopefully it'll get there eventually. If it doesn't seem too difficult, I might even try creating a LE loader for it myself.
Re: Ghidra, NSA's reverse-engineering tool
#419Re: Ghidra, NSA's reverse-engineering tool
#420This is awesome!