4 ms·

How is the experience with Ghidra so far? Does anyone think a true free IDA Pro replacement finally come? I did some reverse engineering for ARM devices last ye

How is the experience with Ghidra so far? Does anyone think a true free IDA Pro replacement finally come? I did some reverse engineering for ARM devices last year, and IDA Pro seemed like the only option but it costs around $1000.

laburn 8y ago
I regularly look at ARM software and firmware. There are certain things that IDA does better, like FLIRT analysis, which I’ve missed since switching to Ghidra. Ghidra also currently lacks support for certain ARM instruction decodings so you can get odd looking disassembly. That isn’t to say you can’t add it. Ghidra has been very nice for reversing C++ code. After filling in most of the members for an object field it makes reversing other subroutines that use the defined type simpler, IMO.
- archontes 8y ago
  Mind if I ask how to get started reverse engineering software?
  - thecatspaw 8y ago
    In my experience, find something you want to find out about a software, and then do that. For example I wanted to write an autosplitter (used for speedrunning) for the witcher 3. So I first had to figure out a plan. I found out that witcher3 is heavily based on facts, and fact-changes. If you progress a quest, thats an entry to the fact-database. I went looking for the method which adds facts to the db, and after a while I found it. Then I hooked it (redirected it to a custom function, which calls the original after my custom code executed), and wrote the rest of the autosplitter.
- kbumsik 8y ago
  Thx for your opinion. What about automatic ARM-Thumb swap on jump instructions? I tried Radare 2 before and it was so hard to work with ARM firmware. If Ghidra supports a proper ARM-Thumb switch, it sounds like a greate alternative to IDA for me.
  - laburn 8y ago
    I don’t normally see ARM with thumb code so I couldn’t tell you. I am fairly certain it is supported but to what degree I am uncertain.
- 0x4a42 8y ago
  It's open-source, you shouldn't need to decompile it. :)
Fnoord 8y ago
Ghidra supports ARM. It is free as in speech and beer, Java (decompiler in C++). From what I heard it phones home though I did not verify the details. IDA Pro is commercial. Only very limited versions without decompiler are free as in beer for personal use. You might also be interested in Radare2 (with Cutter being a Chrome frontend). The command line utility r2 even has syntax highlighting. There are plugins for all of these as well. AFAIK all written in Python.
- yownie 8y ago
  I'd think the phones home part is an answer many would like to know.
  - Fnoord 8y ago
    It is hearsay (person from a security firm told me, don't remember which one). I'm very curious about the update mechanism. Either way, as a Java app it should not be too difficult to decompile it.

laburn 8y ago

I regularly look at ARM software and firmware. There are certain things that IDA does better, like FLIRT analysis, which I’ve missed since switching to Ghidra. Ghidra also currently lacks support for certain ARM instruction decodings so you can get odd looking disassembly. That isn’t to say you can’t add it. Ghidra has been very nice for reversing C++ code. After filling in most of the members for an object field it makes reversing other subroutines that use the defined type simpler, IMO.

archontes 8y ago
Mind if I ask how to get started reverse engineering software?
- thecatspaw 8y ago
  In my experience, find something you want to find out about a software, and then do that. For example I wanted to write an autosplitter (used for speedrunning) for the witcher 3. So I first had to figure out a plan. I found out that witcher3 is heavily based on facts, and fact-changes. If you progress a quest, thats an entry to the fact-database. I went looking for the method which adds facts to the db, and after a while I found it. Then I hooked it (redirected it to a custom function, which calls the original after my custom code executed), and wrote the rest of the autosplitter.
kbumsik 8y ago
Thx for your opinion. What about automatic ARM-Thumb swap on jump instructions? I tried Radare 2 before and it was so hard to work with ARM firmware. If Ghidra supports a proper ARM-Thumb switch, it sounds like a greate alternative to IDA for me.
- laburn 8y ago
  I don’t normally see ARM with thumb code so I couldn’t tell you. I am fairly certain it is supported but to what degree I am uncertain.
0x4a42 8y ago
It's open-source, you shouldn't need to decompile it. :)

Fnoord 8y ago

Ghidra supports ARM. It is free as in speech and beer, Java (decompiler in C++). From what I heard it phones home though I did not verify the details. IDA Pro is commercial. Only very limited versions without decompiler are free as in beer for personal use. You might also be interested in Radare2 (with Cutter being a Chrome frontend). The command line utility r2 even has syntax highlighting. There are plugins for all of these as well. AFAIK all written in Python.

yownie 8y ago
I'd think the phones home part is an answer many would like to know.
- Fnoord 8y ago
  It is hearsay (person from a security firm told me, don't remember which one). I'm very curious about the update mechanism. Either way, as a Java app it should not be too difficult to decompile it.