5 ms·
Download: https://ghidra-sre.org/ https://ghidra-sre.org/ GitHub: https://github.com/NationalSecurityAgency/ghidra https://github.com/NationalSecurityAgency/gh
by twodayslate 8y ago
Download: https://ghidra-sre.org/ https://ghidra-sre.org/
GitHub: https://github.com/NationalSecurityAgency/ghidra https://github.com/NationalSecurityAgency/ghidra
- WrtCdEvrydy 8y agoDownload from the NSA without open source software... anyone else virtualizing three layers deep to get to this?
- aboutruby 8y agoI don't think they would burn some 0-days for this, one container should be enough.
- omeid2 8y agoI think you're underestimating the value of intel on people who know how to get intel or at least interested in the topic.
- est31 8y agoFortunately, a lot of people who are very knowledgeable about reverse engineering are downloading & opening it as we speak. They will point out any flaws/viruses found. Seems one has already been found [1]. All you need to do is to wait. [1]: https://news.ycombinator.com/item?id=19315515 https://news.ycombinator.com/item?id=19315515
- strictnein 8y agoIt's part of the NSA's recruiting push. "If you are interested in projects like this ... consider applying" is even mentioned in the README. There's zero chance there's some secret trojan, because the people who are interested in this type of software are the exact people who would be able to find it.
- whatshisface 8y agoAn RCE vulnerability has already been found.
- weej 8y agoAlso know as debug mode.
- souprock 8y agoIf you specifically start GHIDRA in a debug mode, then yes there is a backdoor, but you asked for that.
- crowbahr 8y agoCalling it a rce vuln is a bit of an exaggeration surely.
- strictnein 8y agoDespite what @HackerFantastic is going on about, sloppy remote debugging capabilities enabled with a debug flag isn't an RCE.
- Tepix 8y agoIt enables remote code execution, that's what RCE stands for.
- JetSpiegel 8y agoIt's a compile flag, it is not enabled by default.
- vonmoltke 8y agoThe issue is with "vulnerability". By that loose definition, every modern IDE has an RCE "vulnerability".
- omeid2 8y agoIt doesn't have to be a secret trojan. Just a trojan is good enough.
- gpm 8y agoAFAICT all the source is there, beside every `.jar` there is a `.zip` with the corresponding source. The source in a more usable form should be posted here soon: https://github.com/NationalSecurityAgency/ghidra/ https://github.com/NationalSecurityAgency/ghidra/ (And if not I'm sure the community will reconstitute it)
- dustindiamond 8y agoOne person’s jar is another’s zip.
- gpm 8y agoWell sure, but the .zip files I'm referring to are "decompiled" for you with nice naming conventions and all that ;)
- gpm 8y agoAfter further investigation my above comment is not true. The decompiler for instance is a precompiled binary (elf64 file on linux) wrapper in some java code. The C/C++/? code is not provided.
- lokedhs 8y agoI'd expect most people who use software like this to be using things like Qubes OS anyway?
- WrtCdEvrydy 8y agoHonestly, not really. I wonder if it will make it's way to FLARE.
- guytv 8y agoIs this available outside the US? the first link returns a 403, the second contains no code... ?
- baud147258 8y agoI was able to see access the first link in France. It might depend on the country?
- dingaling 8y agoDownloaded fine in UK
- ungzd 8y agoSeeing 403 (I'm in Russia). Maybe some export restrictions, but more probably just a glitch in CDN (Cloudfront). P.S. I'm not in Crimea, never encountered software export restrictions before.