5 ms·
Ghidra Decompiler Analysis Engine
- megous 8y agoAmazing. Just what I needed today, when I was writing OpenRisc processor definition for sleigh. :)
- Something1234 8y agoWhat's sleigh?
- danielvf 8y agoSleigh is the processor specification tool for Ghidra. He’s making it so that Ghidra can work with OpenRISC.
- saagarjha 8y agoIt’s “a machine language translation and disassembly engine”: https://ghidra-decompiler-docs.netlify.com/sleigh.html https://ghidra-decompiler-docs.netlify.com/sleigh.html
- person_of_color 8y agoWhat's the difference between OpenRisc and RISC_V?
- megous 8y agoI don't know. I've only came in contact with some old OpenRisc core, via Allwinner SoCs so far and no RISC-V cpus.
- megous 8y agoIn two weekends I've come from no support for OpenRisc at all to this: https://megous.com/dl/tmp/or1k-dec.png https://megous.com/dl/tmp/or1k-dec.png https://megous.com/dl/tmp/or1k-dec2.png https://megous.com/dl/tmp/or1k-dec2.png Ghidra is powerful.
- tango12 8y agoPrev HN thread (recent): https://www.nsa.gov/resources/everyone/ghidra/ https://www.nsa.gov/resources/everyone/ghidra/
- saagarjha 8y ago(That’s not a Hacker News thread)
- cthalupa 8y agoI think https://news.ycombinator.com/item?id=19315273 https://news.ycombinator.com/item?id=19315273 is what you were looking for
- acqq 8y agoThe sources documented in the original post here (Decompiler Analysis Engine, written in C++) weren't openly published before just 3-4 days ago. The post that was about that event, 3 days ago, got only 7 comments. So HN mostly missed that event until now. The sources published earlier were the Java sources, and the engine documented here was only in the binary form.
- archgoon 8y agoIt looks like they managed to finally get the source code released 2 weeks ago. https://github.com/NationalSecurityAgency/ghidra https://github.com/NationalSecurityAgency/ghidra I'm curious as to what prevented them from doing that on day one. Any legal issues presumably would have been worked out prior to the announcement. I guess timelines didn't line up :)
- Aissen 8y agoCode arrived on this repo just 4 days ago. Previously, part of the code was released alongside the binary in a tarball.
- grosswait 8y agoThe wheels of bureaucracy turn slowly
- drakenot 8y agoI originally thought it was because they were waiting for the official announcement at the RSA conference before they released the source code but I guess that wasn't it considering it still took them some time.
- VikingCoder 8y agoIf Ghidra was really good, they wouldn't have had to release the source to it. ;)
- kbumsik 8y agoHow is the experience with Ghidra so far? Does anyone think a true free IDA Pro replacement finally come? I did some reverse engineering for ARM devices last year, and IDA Pro seemed like the only option but it costs around $1000.
- laburn 8y agoI regularly look at ARM software and firmware. There are certain things that IDA does better, like FLIRT analysis, which I’ve missed since switching to Ghidra. Ghidra also currently lacks support for certain ARM instruction decodings so you can get odd looking disassembly. That isn’t to say you can’t add it. Ghidra has been very nice for reversing C++ code. After filling in most of the members for an object field it makes reversing other subroutines that use the defined type simpler, IMO.
- archontes 8y agoMind if I ask how to get started reverse engineering software?
- thecatspaw 8y agoIn my experience, find something you want to find out about a software, and then do that. For example I wanted to write an autosplitter (used for speedrunning) for the witcher 3. So I first had to figure out a plan. I found out that witcher3 is heavily based on facts, and fact-changes. If you progress a quest, thats an entry to the fact-database. I went looking for the method which adds facts to the db, and after a while I found it. Then I hooked it (redirected it to a custom function, which calls the original after my custom code executed), and wrote the rest of the autosplitter.
- kbumsik 8y agoThx for your opinion. What about automatic ARM-Thumb swap on jump instructions? I tried Radare 2 before and it was so hard to work with ARM firmware. If Ghidra supports a proper ARM-Thumb switch, it sounds like a greate alternative to IDA for me.