5 ms·

Bad actors have been using IDA this entire time. So no, not really.

nyrulez 8y ago
You mean there is nothing new here? Then why is this news? I am not wondering about the concept of reverse engineering but the specific (and hopefully novel) feature set that this may enable.
- saagarjha 8y ago
  It's a competitor to IDA's monopoly, basically. It might be better in certain aspects.
  - tptacek 8y ago
    IDA has a bunch of competitors --- Hopper, Binja, and all the Capstone interfaces.
    - saagarjha 8y ago
      Yup, well aware of them (I think Hopper uses Capstone, FWIW). I'm sure you agree that they're not quite at the level of IDA, though ;)
      - tptacek 8y ago
        I'm not especially a fan of IDA, but I don't do much of this work anymore and haven't had a reason to catch up. IDA definitely wouldn't be the first tool I'd reach for in 2019.
        saagarjha 8y ago
        I'm not really a fan either, but it's somewhat better and this makes people seem to like to pass around IDBs…
        tptacek 8y ago
        It's the de facto standard and the program you can assume everyone is already using, plus the fact that a lot of tooling relies on IDA (in part because, for a long time, it was the only game in town) for analysis and function recovery. I don't know if that really makes it "better". I got out of this stuff before decompilation became a mainstream feature, so it might be a big deal that Ghidra has a strong decompiler.
        saagarjha 8y ago
        Yeah, that's basically it. Most other tools either lack a decompiler or have a somewhat poorer one.
    - monocasa 8y ago
      So, albeit my use case is a little weird I guess, and I generally am using it for embedded systems, but: Hopper - is Capstone. BinaryNinja - The extension API isn't well documented last time I checked. Embedded systems sort of requires letting me fill in some of the gaps myself. Capstone - I got frustrated when the translation script behind it that autogens code from the LLVM definitions wasn't available (as source or otherwise) which meant that I couldn't add to the instruction set in a meaningful way like I needed to. Radare(2) - Feels like the barely glued together independent projects that it is. Somehow has a more inscrutable interface than IDA. One of the frontends I tried (can't remember if it was Hopper, Clipper, or something else) for some reason thought PowerPC had branch delay slots, which was totally screwing up the basic block determination.
- jchw 8y ago
  Conceptually there's nothing new, but it doesn't hurt to have more options available, especially considering how pricey IDA is.
- __jal 8y ago
  There are more options in the universe of reactions than "Eek! They're going to get us all killed!" and "Eh?"
gpm 8y ago
Bad actors have had access to this tool too... it was leaked previously. This is cool because: - It's legal and free - It's open source
- willstrafach 8y ago
  The tool was never leaked previously.
  - gpm 8y ago
    Uh, you're sure about that? I can't say I have first hand experience with the leak (running second hand NSA software not meant for public release seems like a bad idea somehow) but I know I've heard that it was, and this seems pretty suggestive... https://wikileaks.org/ciav7p1/cms/page_51183656.html https://wikileaks.org/ciav7p1/cms/page_51183656.html
    - willstrafach 8y ago
      I am sure about that. Your linked informational page leaked out when someone sent WikiLeaks a dump from a classified Confluence used by CIA’s cyber folks. The tool itself, however, had not leaked.

You mean there is nothing new here? Then why is this news? I am not wondering about the concept of reverse engineering but the specific (and hopefully novel) feature set that this may enable.

saagarjha 8y ago
It's a competitor to IDA's monopoly, basically. It might be better in certain aspects.
- tptacek 8y ago
  IDA has a bunch of competitors --- Hopper, Binja, and all the Capstone interfaces.
  - saagarjha 8y ago
    Yup, well aware of them (I think Hopper uses Capstone, FWIW). I'm sure you agree that they're not quite at the level of IDA, though ;)
    - tptacek 8y ago
      I'm not especially a fan of IDA, but I don't do much of this work anymore and haven't had a reason to catch up. IDA definitely wouldn't be the first tool I'd reach for in 2019.
      - saagarjha 8y ago
        I'm not really a fan either, but it's somewhat better and this makes people seem to like to pass around IDBs…
        tptacek 8y ago
        It's the de facto standard and the program you can assume everyone is already using, plus the fact that a lot of tooling relies on IDA (in part because, for a long time, it was the only game in town) for analysis and function recovery. I don't know if that really makes it "better". I got out of this stuff before decompilation became a mainstream feature, so it might be a big deal that Ghidra has a strong decompiler.
        saagarjha 8y ago
        Yeah, that's basically it. Most other tools either lack a decompiler or have a somewhat poorer one.
  - monocasa 8y ago
    So, albeit my use case is a little weird I guess, and I generally am using it for embedded systems, but: Hopper - is Capstone. BinaryNinja - The extension API isn't well documented last time I checked. Embedded systems sort of requires letting me fill in some of the gaps myself. Capstone - I got frustrated when the translation script behind it that autogens code from the LLVM definitions wasn't available (as source or otherwise) which meant that I couldn't add to the instruction set in a meaningful way like I needed to. Radare(2) - Feels like the barely glued together independent projects that it is. Somehow has a more inscrutable interface than IDA. One of the frontends I tried (can't remember if it was Hopper, Clipper, or something else) for some reason thought PowerPC had branch delay slots, which was totally screwing up the basic block determination.
jchw 8y ago
Conceptually there's nothing new, but it doesn't hurt to have more options available, especially considering how pricey IDA is.
__jal 8y ago
There are more options in the universe of reactions than "Eek! They're going to get us all killed!" and "Eh?"

gpm 8y ago

Bad actors have had access to this tool too... it was leaked previously. This is cool because: - It's legal and free - It's open source

willstrafach 8y ago
The tool was never leaked previously.
- gpm 8y ago
  Uh, you're sure about that? I can't say I have first hand experience with the leak (running second hand NSA software not meant for public release seems like a bad idea somehow) but I know I've heard that it was, and this seems pretty suggestive... https://wikileaks.org/ciav7p1/cms/page_51183656.html https://wikileaks.org/ciav7p1/cms/page_51183656.html
  - willstrafach 8y ago
    I am sure about that. Your linked informational page leaked out when someone sent WikiLeaks a dump from a classified Confluence used by CIA’s cyber folks. The tool itself, however, had not leaked.