81–90 of 231 posts
Earlier quoted context omitted.
Almost every hobbyist reverse engineer uses cracked IDA which is easily available. I have never seen ghidra being recommended for serious work.
The NSA doesn't do serious work?
Earlier quoted context omitted.
+1 I once tried learning how to RE with radare2 but got very frustrated by frequent project file corruption (meaning radare2 could no longer open it). The way these project files work(ed?) in radare2 at the time was that it just saved all the commands you executed, instead of the state. This was brittle, in my experience. I don't have a lot of free time, so I have to leave projects for long periods of time, not being…
I tried radare2 with the official GUI Iaito. Iaito saves the project in a git repo, so whenever I got corruption (and I got it a lot, like every 4-5 saves) I was just a `git reset --hard` away from restoring a good state. Not the most efficient way of operation, but for me it was better this than tolerating Ghidra's tiny Courier New font.
Your corruption frequency anecdote matches mine. I don't have the mental werewithal to deal with that. I won't go back to radare2 until they change their project file stability somehow.
Can anyone provide their opinion of Ghidra vs Ida? Is Ida worth the extra money?
Almost every hobbyist reverse engineer uses cracked IDA which is easily available. I have never seen ghidra being recommended for serious work.
Earlier quoted context omitted.
Just use the official github link or links that are linked there. The URL you mentioned seems bogus at best.
Curious, the ghidralite page download button links to the NSA's github releases page. I wonder what is the purpose of ghidralite dot com. SEO spam? Are they building trust and then will swap out the Download button with a poisoned binary.
Earlier quoted context omitted.
+1 I once tried learning how to RE with radare2 but got very frustrated by frequent project file corruption (meaning radare2 could no longer open it). The way these project files work(ed?) in radare2 at the time was that it just saved all the commands you executed, instead of the state. This was brittle, in my experience. I don't have a lot of free time, so I have to leave projects for long periods of time, not being…
Yes, we are working on rewriting analysis completely[1][2] that would fix your issue along with many others. [1] https://github.com/rizinorg/rizin/pull/5505 [2] https://github.com/rizinorg/rizin/issues/4736
(Funny expression, that. I'll wait, of course. It'll be a happy day when this works again and I can slowly make progress RE'ing again.)
I always wondered whether they have a much more capable internal version. And I wonder the same thing for AI labs (they have to do a lot of lobotomy for their models to be ready for public use... but internally, they can just skip this perhaps?)
I doubt it. Ghidra is extremely extensible with their plugin/tool architecture. Public Ghidra includes the extremely helpful decompiler tool, and a few others, but I'm willing to bet that NSA uses regular Ghidra + some way more capable plugins instead of having another Ghidra.
I think what NSA is likely to keep confidential are in-house plugins that are so specialized and/or underengineered that their publication would give away confidential information: stolen and illegitimate secrets (e.g. cryptographic private keys from a game console SDK), or exploits that they intend to deny knowledge of and continue milking, or general strategies and methods (e.g. a tool to "customize" UEFI images, with the implication that they have means to install them on a victim's computer).
Binary Ninja deserves a mention in these threads: https://binary.ninja I've used IDA, Ghidra, and Binary Ninja a lot over the years. At this point I much prefer Binary Ninja for the task of building up an understanding of large binaries with many thousands of types and functions. It also doesn't hurt that its UI/UX feel like something out of this century, and it's very easy to automate using Python scripts.
Earlier quoted context omitted.
Yes, we are working on rewriting analysis completely[1][2] that would fix your issue along with many others. [1] https://github.com/rizinorg/rizin/pull/5505 [2] https://github.com/rizinorg/rizin/issues/4736
Can't wait! Do you have any idea how far along this is? Is it likely to be months, quarters, years? (Funny expression, that. I'll wait, of course. It'll be a happy day when this works again and I can slowly make progress RE'ing again.)