Ghidra by NSA • Hacker News Board

Re: Ghidra by NSA

#61

Post by q3k » Mon, Feb 16, 2026, 4:15 PM UTC

apple1417 wrote: post #56

yibers wrote: post #18

Can anyone provide their opinion of Ghidra vs Ida? Is Ida worth the extra money?

Leading this by saying I've only used Ida free, I can't comment on Ida pro. I'm also a very lite user of both, I give name functions/vars, save bookmarks, and occasionally work out custom types, and that's about it, none of the real fancy stuff. I was recently trying to analyse a 600mb exe (denuvo/similar). I wasted a week after ghidra crashed 30h+ in multiple times. A seperate project with a 300mb exe took about 5h,…

> I was recently trying to analyse a 600mb exe (denuvo/similar). I wasted a week after ghidra crashed 30h+ in multiple times.

During the startup auto analysis? For large binaries it makes sense to dial back the number of analysis passes and only trigger them if you really need them, manually, one by one. You also get to save in between different passes.

Re: Ghidra by NSA

#62

Post by LPisGood » Mon, Feb 16, 2026, 4:19 PM UTC

flipped wrote: post #33

[flagged]

Well it’s open source, so you can check in principle. I would imagine there’s some fame and notoriety in discovering that.

Re: Ghidra by NSA

#63

Post by apple1417 » Mon, Feb 16, 2026, 4:21 PM UTC

q3k wrote: post #61

apple1417 wrote: post #56

Earlier quoted context omitted.

Leading this by saying I've only used Ida free, I can't comment on Ida pro. I'm also a very lite user of both, I give name functions/vars, save bookmarks, and occasionally work out custom types, and that's about it, none of the real fancy stuff. I was recently trying to analyse a 600mb exe (denuvo/similar). I wasted a week after ghidra crashed 30h+ in multiple times. A seperate project with a 300mb exe took about 5h,…

> I was recently trying to analyse a 600mb exe (denuvo/similar). I wasted a week after ghidra crashed 30h+ in multiple times. During the startup auto analysis? For large binaries it makes sense to dial back the number of analysis passes and only trigger them if you really need them, manually, one by one. You also get to save in between different passes.

Yup. It was actually an openjdk crash, which was extra interesting.

I figured I probably could remove some passes, but being a lite user I don't really know/didn't want to spend the time learning how important each one is and how long they take. Ida's defaults were just better.

Re: Ghidra by NSA

#64

Post by Alifatisk » Mon, Feb 16, 2026, 4:23 PM UTC

jakozaur wrote: post #47

Funny thing, AI is not that terrible at using Ghidra. We released a benchmark on that and hopefully models will improve: https://quesma.com/blog/introducing-binaryaudit/

There is MCPs for Ghidra

Re: Ghidra by NSA

#65

Post by Alifatisk » Mon, Feb 16, 2026, 4:26 PM UTC

There is also Hopper for ObjC/Swift, haven't tried it personally though

https://www.hopperapp.com

Re: Ghidra by NSA

#66

Post by mdavid626 » Mon, Feb 16, 2026, 4:26 PM UTC

mickeyp wrote: post #22

mdavid626 wrote: post #13

Works well. I used this tool once to disassemble and understand how key manager works on Vivotek cameras. They create executables, which contain encrypted binary data. Then, when the executable runs, it decodes the encrypted data and pipes it into "sh". The security is delusional here - the password is hard coded in the executable. It was something like "VIVOTEK Inc.". Ghidra was able to create the C code and I was a…

Sounds like `strings' on the binary would've sufficed if it's just hardcoded.

No, that’s not enough.

The password would be visible, but the encyption algorithm and the script’s text wouldn’t.

Re: Ghidra by NSA

#67

Post by alberto-m » Mon, Feb 16, 2026, 4:30 PM UTC

aktau wrote: post #34

xvilka wrote: post #2

Cutter[1] by RizinOrg[2]. [1] https://github.com/rizinorg/cutter [2] https://github.com/rizinorg/rizin

+1 I once tried learning how to RE with radare2 but got very frustrated by frequent project file corruption (meaning radare2 could no longer open it). The way these project files work(ed?) in radare2 at the time was that it just saved all the commands you executed, instead of the state. This was brittle, in my experience. I don't have a lot of free time, so I have to leave projects for long periods of time, not being…

I tried radare2 with the official GUI Iaito. Iaito saves the project in a git repo, so whenever I got corruption (and I got it a lot, like every 4-5 saves) I was just a `git reset --hard` away from restoring a good state. Not the most efficient way of operation, but for me it was better this than tolerating Ghidra's tiny Courier New font.

Re: Ghidra by NSA

#68

Post by jeevacation » Mon, Feb 16, 2026, 4:33 PM UTC

13hunteo wrote: post #17

jeevacation wrote: post #10

[flagged]

You have a disgusting username

[dead]

Re: Ghidra by NSA

#69

Post by joe_mamba » Mon, Feb 16, 2026, 4:35 PM UTC

Alifatisk wrote: post #64

jakozaur wrote: post #47

Funny thing, AI is not that terrible at using Ghidra. We released a benchmark on that and hopefully models will improve: https://quesma.com/blog/introducing-binaryaudit/

There is MCPs for Ghidra

Yeah this. I saw some guys on youtube use AI MCPs to do some crazy reverse engineering.

It's difficult to be an AI doomer when you see stuff like this.

Re: Ghidra by NSA

#70

Post by nazgulsenpai » Mon, Feb 16, 2026, 4:36 PM UTC

quux0r wrote: post #31

While on the topic, I want to highlight two incredible plugins for Ghidra: https://github.com/jtang613/GhidrAssist And https://github.com/jtang613/GhidrAssistMCP Being able to hook Claude code up to this has made reversing way more productive. Highly recommend!

https://github.com/LaurieWired/GhidraMCP is great also