7 ms·

Ghidra

103 points by jakobdabo 8y ago

amiga-workbench 8y ago
Uhh, what's this about? https://i.imgur.com/e3kNYTH.png https://i.imgur.com/e3kNYTH.png
- captn3m0 8y ago
  Link, in case someone wants to dig further. https://nsa.dod.afpims.mil/ https://nsa.dod.afpims.mil/
  - hermitdev 8y ago
    403'd for me...was forced from https to http for some reason (on mobile with JS disabled - maybe a factor?).
  - richardwhiuk 8y ago
    I get: > You cannot visit nsa.dod.afpims.mil at the moment because the website sent scrambled credentials that Google Chrome cannot process. Network errors and attacks are usually temporary, so this page will probably work later.
- mcpherrinm 8y ago
  I haven't worked at US government so I am not 100% sure of the details, but this is my understanding: HTTPS (tls, really) allows clients to present a certificate, just like the server does. This is commonly used, eg, for microservices authenticating to each other in a backend. It is less commonly used for people to authenticate to servers. In particular, the "Common Access Card" is the ID badge used by the DoD, various parts of the armed forces, and in particular the NSA (whose website this is). Those access cards have a key and certificate usable for this. So your keyboard (or laptop) has a smartcard reader in it, and you can insert your ID badge (maybe with a PIN? not sure if usa gov't does that) to log into any website. Browser UX for this isn't great. Unlike the newer Webauthn specs where javascript (and thus site-specific instructions) can ask you to log in, the browser has to prompt you in a very generic way to present your certificate.
  - unknownknowns 8y ago
    Client certificate PKI is common in this space. Even if it's just a local cert on the user's profile, it works really well as SSO.
  - Godel_unicode 8y ago
    I actually prefer the browser UX for client cert authentication; since it's presented by the browser it's harder to do nefarious things with JavaScript to confuse the user as to what site is requesting authentication. Edit: for what it's worth, the executive agencies are all required to use PIV (essentially civilian CAC) to authenticate, and those PIVs are required to have significant physical controls including requiring a PIN for access. It's a pretty robust way of enforcing 2fa.
  - amiga-workbench 8y ago
    Thanks for the info, I had no idea this was possible. I'm tempted to give it a go on my site.
chc4 8y ago
There was a thread on HN when they first announced a public release at RSA[0]. A lot of reverse engineers I know are excited for it. 0: https://news.ycombinator.com/item?id=18828083 https://news.ycombinator.com/item?id=18828083
- dang 8y ago
  Since that was less than two months ago, the current submission counts as a dupe. When it's open-sourced, that will be significant new information, which makes for a new story. It will certainly be discussed by HN then. https://hn.algolia.com/?query=%22significant%20new%20information%22&sort=byDate&dateRange=all&type=comment&storyText=false&prefix=false&page=0 https://hn.algolia.com/?query=%22significant%20new%20informa...
slimsag 8y ago
My brother is into reverse engineering, he is literally counting the days to the open source release of this. He said there isn't anything quite like it as it can actually stand toe-to-toe with IDA Pro, the commercial software that apparently nothing yet can really beat.
- chc4 8y ago
  Yup. IDA Pro is the gold standard, and was basically the only choice for a long time. It's also stupidly expensive and priced for defense contractor funny money, with an individual license nearly $3000 [0]. Most freelancers just use a cracked copy or the freeware version. Recently Hopper and BinaryNinja have been rising in use, with much more affordable pricing plans, but they're still second-rate as far as I know. (There's also radare2, which for all it's mentioned occasionally I don't actually know anyone that uses it) 0: https://www.hex-rays.com/cgi-bin/quote.cgi https://www.hex-rays.com/cgi-bin/quote.cgi
  - joshschreuder 8y ago
    I've always wondered this - there's a real "pay for your useful tools" philosophy on here at least, for things like Sublime Text. Often quoted is the cost per hour of use, etc. which justify the price (which is admittedly low compared to Ida). Does the same not apply to Ida where you would make the money back fast enough to justify the pricetag? Or is it that there are more hobbyists and less people making actual money from using Ida?
    - pm90 8y ago
      This is basically how a monopoly works. And the defense industry behaves like a monopoly even if its made up of a bunch of different companies.
      - Godel_unicode 8y ago
        I disagree, I think there's an important difference between a monopoly and a company that happens to have no competition at the moment. I think that active anti-competitive actions are one of the defining characteristics of a monopoly, and so far we haven't seen that behavior from hex-rays. They had a significant barrier to entry protecting them, in that making a decompiler (the hex rays decompiler is the expensive part of "Ida") is hard, and the market is (was?) small. Consider the difference between Standard Oil and Adobe. Photoshop was the only game in town not because Adobe lost money on it to drive out rivals but because it's hard to make software that does what Photoshop does.
ypolito 8y ago
Can't wait to try it and read articles comparing its features with IDA, Binary Ninja, radare2 or Hopper. Sounds really interesting!
aboutruby 8y ago
On a sidenote, looking at their Github, they publish a lot of names / emails in the git logs (~100). Some are encoded / anonymous, but most are real looking names and plausible email addresses.
crb002 8y ago
Good to see NSA has got on board that removing the attack surface of US software is a top priority.
tribby 8y ago
an open source competitor to IDA pro is very welcome, never thought it would come from NSA. have they said anything about their motivation to open-source it?
- monocasa 8y ago
  Probably to crowd source maintenance like nearly every other closed to open transition. And ghidra has been leaked a few times (they give it out like candy to contractors) so they're not really losing much.
  - weaksauce 8y ago
    any reports on if it's better than IDA?
    - monocasa 8y ago
      I've heard that it's about equal in power, but different. Ghidra has a bigger emphasis on working with the decompiled output; you spend nearly all your time in the decompiler whereas in IDA you flip back and for decompiler (if you have it) and disassembler.
os2mac 8y ago
I'm still trying to figure out, in this day and age, especially after the Snowden disclosures, why anyone would trust software released by this organization. you do realize their primary goal is intelligence gathering?
- artemisbot 8y ago
  It's going to be an open source release so depending on your paranoia levels you could just build it yourself.
  - drchaos 8y ago
    You'd have to audit the source code first, though, which is not a trivial thing to do.
    - gpm 8y ago
      Given the audience I feel like the source code will be audited by the community in record time.
      - Godel_unicode 8y ago
        I don't get the criticism here, you're right on the money. What's the one group of people absolutely guaranteed to a) audit a tool like this and b) have the chops to perform that audit Reverse engineers. If you're nervous, just wait 2 months and follow Twitter.
    - kbenson 8y ago
      But you can bet there will be plenty of people looking at it, and that group of people will also likely include security professionals looking to use it. I'm not sure I can honestly think of a stupider move in this area than to include nefarious code in an open source security auditing tool aimed at the highest and most complex levels of security auditing and used by professionals whose job it is to find and announce these things. That doesn't mean assume nothing's wrong, but I'm pretty sure this thing will have some pretty talented people looking at it fairly early just for kicks, so of things to worry about, this isn't high on my list.
gpm 8y ago
I wonder what the NSA does with the analytics on a page like this.
TimTheTinker 8y ago
NSA releasing an open-source tool? My first thought is, better subject it to serious, in-depth security review before installing it locally. Even then, build it from source.
- mahmoudimus 8y ago
  Apache NiFi was also released by the NSA & has seen commercial success in the enterprise.
  - snazz 8y ago
    Not to mention SELinux, which was partly developed by the NSA. Red Hat is much more involved in that, though.
  - TimTheTinker 8y ago
    Right, but it’s probably been reviewed and we’re not using NSA binaries.
  - rplst8 8y ago
    And Accumulo.
  - hermitdev 8y ago
    Wans't Tor initially developed by NSA/CIA as well?
    - grzm 8y ago
      > "The core principle of Tor, "onion routing", was developed in the mid-1990s by United States Naval Research Laboratory employees, mathematician Paul Syverson, and computer scientists Michael G. Reed and David Goldschlag, with the purpose of protecting U.S. intelligence communications online. Onion routing was further developed by DARPA in 1997." https://en.wikipedia.org/wiki/Tor_(anonymity_network)#History https://en.wikipedia.org/wiki/Tor_(anonymity_network)#Histor...
- appleflaxen 8y ago

Ghidra

103 points by jakobdabo 8y ago

amiga-workbench 8y ago

Uhh, what's this about? https://i.imgur.com/e3kNYTH.png https://i.imgur.com/e3kNYTH.png

captn3m0 8y ago
Link, in case someone wants to dig further. https://nsa.dod.afpims.mil/ https://nsa.dod.afpims.mil/
- hermitdev 8y ago
  403'd for me...was forced from https to http for some reason (on mobile with JS disabled - maybe a factor?).
- richardwhiuk 8y ago
  I get: > You cannot visit nsa.dod.afpims.mil at the moment because the website sent scrambled credentials that Google Chrome cannot process. Network errors and attacks are usually temporary, so this page will probably work later.
mcpherrinm 8y ago
I haven't worked at US government so I am not 100% sure of the details, but this is my understanding: HTTPS (tls, really) allows clients to present a certificate, just like the server does. This is commonly used, eg, for microservices authenticating to each other in a backend. It is less commonly used for people to authenticate to servers. In particular, the "Common Access Card" is the ID badge used by the DoD, various parts of the armed forces, and in particular the NSA (whose website this is). Those access cards have a key and certificate usable for this. So your keyboard (or laptop) has a smartcard reader in it, and you can insert your ID badge (maybe with a PIN? not sure if usa gov't does that) to log into any website. Browser UX for this isn't great. Unlike the newer Webauthn specs where javascript (and thus site-specific instructions) can ask you to log in, the browser has to prompt you in a very generic way to present your certificate.
- unknownknowns 8y ago
  Client certificate PKI is common in this space. Even if it's just a local cert on the user's profile, it works really well as SSO.
- Godel_unicode 8y ago
  I actually prefer the browser UX for client cert authentication; since it's presented by the browser it's harder to do nefarious things with JavaScript to confuse the user as to what site is requesting authentication. Edit: for what it's worth, the executive agencies are all required to use PIV (essentially civilian CAC) to authenticate, and those PIVs are required to have significant physical controls including requiring a PIN for access. It's a pretty robust way of enforcing 2fa.
- amiga-workbench 8y ago
  Thanks for the info, I had no idea this was possible. I'm tempted to give it a go on my site.

chc4 8y ago

There was a thread on HN when they first announced a public release at RSA[0]. A lot of reverse engineers I know are excited for it. 0: https://news.ycombinator.com/item?id=18828083 https://news.ycombinator.com/item?id=18828083

dang 8y ago
Since that was less than two months ago, the current submission counts as a dupe. When it's open-sourced, that will be significant new information, which makes for a new story. It will certainly be discussed by HN then. https://hn.algolia.com/?query=%22significant%20new%20information%22&sort=byDate&dateRange=all&type=comment&storyText=false&prefix=false&page=0 https://hn.algolia.com/?query=%22significant%20new%20informa...

slimsag 8y ago

My brother is into reverse engineering, he is literally counting the days to the open source release of this. He said there isn't anything quite like it as it can actually stand toe-to-toe with IDA Pro, the commercial software that apparently nothing yet can really beat.

chc4 8y ago
Yup. IDA Pro is the gold standard, and was basically the only choice for a long time. It's also stupidly expensive and priced for defense contractor funny money, with an individual license nearly $3000 [0]. Most freelancers just use a cracked copy or the freeware version. Recently Hopper and BinaryNinja have been rising in use, with much more affordable pricing plans, but they're still second-rate as far as I know. (There's also radare2, which for all it's mentioned occasionally I don't actually know anyone that uses it) 0: https://www.hex-rays.com/cgi-bin/quote.cgi https://www.hex-rays.com/cgi-bin/quote.cgi
- joshschreuder 8y ago
  I've always wondered this - there's a real "pay for your useful tools" philosophy on here at least, for things like Sublime Text. Often quoted is the cost per hour of use, etc. which justify the price (which is admittedly low compared to Ida). Does the same not apply to Ida where you would make the money back fast enough to justify the pricetag? Or is it that there are more hobbyists and less people making actual money from using Ida?
  - pm90 8y ago
    This is basically how a monopoly works. And the defense industry behaves like a monopoly even if its made up of a bunch of different companies.
    - Godel_unicode 8y ago
      I disagree, I think there's an important difference between a monopoly and a company that happens to have no competition at the moment. I think that active anti-competitive actions are one of the defining characteristics of a monopoly, and so far we haven't seen that behavior from hex-rays. They had a significant barrier to entry protecting them, in that making a decompiler (the hex rays decompiler is the expensive part of "Ida") is hard, and the market is (was?) small. Consider the difference between Standard Oil and Adobe. Photoshop was the only game in town not because Adobe lost money on it to drive out rivals but because it's hard to make software that does what Photoshop does.

ypolito 8y ago

Can't wait to try it and read articles comparing its features with IDA, Binary Ninja, radare2 or Hopper. Sounds really interesting!

aboutruby 8y ago

On a sidenote, looking at their Github, they publish a lot of names / emails in the git logs (~100). Some are encoded / anonymous, but most are real looking names and plausible email addresses.

crb002 8y ago

Good to see NSA has got on board that removing the attack surface of US software is a top priority.

tribby 8y ago

an open source competitor to IDA pro is very welcome, never thought it would come from NSA. have they said anything about their motivation to open-source it?

monocasa 8y ago
Probably to crowd source maintenance like nearly every other closed to open transition. And ghidra has been leaked a few times (they give it out like candy to contractors) so they're not really losing much.
- weaksauce 8y ago
  any reports on if it's better than IDA?
  - monocasa 8y ago
    I've heard that it's about equal in power, but different. Ghidra has a bigger emphasis on working with the decompiled output; you spend nearly all your time in the decompiler whereas in IDA you flip back and for decompiler (if you have it) and disassembler.

os2mac 8y ago

I'm still trying to figure out, in this day and age, especially after the Snowden disclosures, why anyone would trust software released by this organization. you do realize their primary goal is intelligence gathering?

artemisbot 8y ago
It's going to be an open source release so depending on your paranoia levels you could just build it yourself.
- drchaos 8y ago
  You'd have to audit the source code first, though, which is not a trivial thing to do.
  - gpm 8y ago
    Given the audience I feel like the source code will be audited by the community in record time.
    - Godel_unicode 8y ago
      I don't get the criticism here, you're right on the money. What's the one group of people absolutely guaranteed to a) audit a tool like this and b) have the chops to perform that audit Reverse engineers. If you're nervous, just wait 2 months and follow Twitter.
  - kbenson 8y ago
    But you can bet there will be plenty of people looking at it, and that group of people will also likely include security professionals looking to use it. I'm not sure I can honestly think of a stupider move in this area than to include nefarious code in an open source security auditing tool aimed at the highest and most complex levels of security auditing and used by professionals whose job it is to find and announce these things. That doesn't mean assume nothing's wrong, but I'm pretty sure this thing will have some pretty talented people looking at it fairly early just for kicks, so of things to worry about, this isn't high on my list.

gpm 8y ago

I wonder what the NSA does with the analytics on a page like this.

TimTheTinker 8y ago

NSA releasing an open-source tool? My first thought is, better subject it to serious, in-depth security review before installing it locally. Even then, build it from source.

mahmoudimus 8y ago
Apache NiFi was also released by the NSA & has seen commercial success in the enterprise.
- snazz 8y ago
  Not to mention SELinux, which was partly developed by the NSA. Red Hat is much more involved in that, though.
- TimTheTinker 8y ago
  Right, but it’s probably been reviewed and we’re not using NSA binaries.
- rplst8 8y ago
  And Accumulo.
- hermitdev 8y ago
  Wans't Tor initially developed by NSA/CIA as well?
  - grzm 8y ago
    > "The core principle of Tor, "onion routing", was developed in the mid-1990s by United States Naval Research Laboratory employees, mathematician Paul Syverson, and computer scientists Michael G. Reed and David Goldschlag, with the purpose of protecting U.S. intelligence communications online. Onion routing was further developed by DARPA in 1997." https://en.wikipedia.org/wiki/Tor_(anonymity_network)#History https://en.wikipedia.org/wiki/Tor_(anonymity_network)#Histor...
appleflaxen 8y ago