8 ms·

Ghidra 9.2

203 points by KindOne 6y ago

KindOne 6y ago
Previous discussion when it was announced back in 2019, with 400+ comments: https://news.ycombinator.com/item?id=19315273 https://news.ycombinator.com/item?id=19315273
zelly 6y ago
Still waiting for a built-in debugger like IDA has
- 29athrowaway 6y ago
  Not built in, but useful: - edb (https://github.com/eteran/edb-debugger https://github.com/eteran/edb-debugger) - x64dbg (https://x64dbg.com https://x64dbg.com)
- moonchild 6y ago
  Radare2[0] has a debugger (among other things), and can integrate with ghidra's decompiler[1]. 0. https://rada.re/ https://rada.re/ 1. https://github.com/radareorg/r2ghidra https://github.com/radareorg/r2ghidra
- molticrystal 6y ago
  The latest news on that debugger is from a reply to an issue [0] on June 17th, 2020: >As @ryanmkurtz mentioned work is continuing on the debugger, it is a large job and there have been many issues that have come up, not the least of which is COVID. We would really like to give you a timeline, but I don't want to promise anything and not deliver in a timely manner. Dynamic analysis and easy integration of dynamic information is important to the Ghidra community as is evidenced in the thread. >IMHO, I would not hesitate to learn/use any tool, as the knowledge gained can always be ported to another tool. Time spent learning other debuggers, such as gdb or windbg, will not be wasted as the new Ghidra based debugger will be integrated with existing debuggers or have considerable overlap with their command sets and functionality. That said, if another tool fits your needs, use it. There are many great things about each RE tool and reasons to use or not use each. >Rest assured we are diligently working on the debugger and we think it will be worth the wait. We'll share information on features and release when we have solid timelines. >Thanks for using Ghidra in whatever way fits your work. Feel free to request features/improvements you see lacking and we and the community will try to address them. >We'll close the issue for now. -------------------------- Also from the What's New 9.2 release notes: >Dynamic Analysis Framework - Debugger >The debugger is very much still in progress. You may have seen some commits, in the Ghidra GitHub master branch, to get in sync with the debugger. Stay tuned for more on the Dynamic Analysis Framework soon after the 9.2 release. [0] https://github.com/NationalSecurityAgency/ghidra/issues/24#issuecomment-645425059 https://github.com/NationalSecurityAgency/ghidra/issues/24#i...
- archgoon 6y ago
  Have you tried https://github.com/bootleg/ret-sync https://github.com/bootleg/ret-sync ?
dx87 6y ago
For anyone looking to learn Ghidra and finding it a little overwhelming, a Ghidra book was recently released. I'm finding it very helpful so far. https://nostarch.com/GhidraBook https://nostarch.com/GhidraBook
- huntsman 6y ago
  I'd also highly recommend the training course slides that are included in the Ghidra distribution. The "Advanced" course especially covers some cool tricks and ways Ghidra is different from IDA/Binary Ninja.
- 29athrowaway 6y ago
  A review of the Ghidra book https://maxkersten.nl/2020/09/13/a-review-of-the-ghidra-book/ https://maxkersten.nl/2020/09/13/a-review-of-the-ghidra-book...
- sidewinder 6y ago
  SANS FOR610: Reverse Engineering Malware also has updated content to teach Ghidra.
  - nostoc 6y ago
    Unless it changed since it incorporated Ghidra, SANS FOR610 has a very shallow look into actual static reversing of native code. It's a good introduction but does not venture far.
- tptacek 6y ago
  Reprising a previous comment: this book is good, but fair warning that it's not, like, a fun read; it's like one of those books from the 1990s that explains every dialog box in Microsoft Word. It's an excellent reference, but if you're just getting started reversing, Eidad Eilam's _Reversing_ is still a good choice. Part of the reason I keep saying this is, if you've done reversing work with IDA or Hopper, you can fumble your way to productivity with Ghidra without a book. So: if Ghidra is completely greek to you, start maybe with fundamentals.
- 6y ago
0xquad 6y ago
Is there a database of already analyzed objects? For example, can I search on the sha256sum of my IoT device's firmware and see if someone else has done the heavy lifting?
- mdaniel 6y ago
  That would be awesome, like GhidraHub or something I'm not well versed in the legality of publishing those databases, as some discussions I've heard elsewhere treat them the same as the object code they annotate and thus it would be like publishing the .exe from Photoshop. I would guess it's possible to separate the annotations from the object code, similar to the way subtitle files are shared for the movies, but similar to a wrong subtitle file, it would take some doing to discover it and more doing to try and rescue the annotations if they could apply to a slightly different but still applicable binary
- MyAltAccount 6y ago
  No. I know IDA has a "Lumina" database. https://www.hex-rays.com/products/ida/lumina/ https://www.hex-rays.com/products/ida/lumina/ Someone has made a public "Lumina" database for IDA. https://lumen.abda.nl/ https://lumen.abda.nl/ If you don't have a legit copy of IDA, you can always pirate a copy and use that public "Lumina" server.
  - Quarrel 6y ago
    V Nice. Thanks for the Lumen link.
  - muldvarp 6y ago
    If there was any public documentation on the "Lumina" protocol, one could create a Ghidra plugin that interacts with the server. Sadly, I don't have a copy of IDA (and therefore cannot reverse engineer the protocol) and the author of lumen.abda.nl hasn't released the source code.
- mhh__ 6y ago
  I'm sure Ghidra's creator's have one
mettamage 6y ago
Currently, I don't get Ghidra that much. But I appreciate the decompiler. While it isn't perfect, it reverses simple functions to C like pseudo-code a lot faster than I can (not that I'm fast at that anyway). Combining it with the free version of IDA (the disassembler, not the decompiler of IDA) has helped me a lot with hackthebox.eu challenges :)
- jcranmer 6y ago
  I've never tried IDA Pro's decompiler, but my most recent experience with the Ghidra decompiler had me going back to my tried-and-true hand decompilation steps. (Admittedly, the function in question had a switch statement that had sparse and dense cases (with holes in the dense block!), which is definitely going to do a decent job of confusing native decompilers).
  - mettamage 6y ago
    Oh dear, yea no switch statement when I needed to use it. A lot of byte/bit flipping.
  - Sesse__ 6y ago
    I've used Hex-Rays (IDA Pro's decompiler); not full-time, but 100+ hours, including professionally. My information is a few years out of date, but I think most of it is still current. I've also used Ghidra (9.1) for maybe 50 hours or so. First, let me say: Both are leaps and bounds above _anything_ else out there. Stuff like Hopper is basically just assembler code in a different syntax; Hex-Rays and Ghidra are real, working, useful decompilers. Hex-Rays charges four-figure sums for single licenses, and it's because the product is utterly worth it if you do this kind of thing for a living (or at least was before Ghidra came along). I would estimate it speeds up reverse-engineering by 10x. There's a wonderful interactivity where the decompiler does all the boring book-keeping for you, and you keep feeding it info and it tells you stuff in return. Decompiling is often about figuring out data structures; both will infer a lot of struct types and sometimes even names based on usage and surrounding code. This is _so incredibly useful_. When you give a field a type or a name, it propagates throughout the program and gives you new understanding. Both products are weird and have arcane UIs. IDA/Hex-Rays feels more ergonomical to me, though (for instance, highlighting happens automatically instead of having to middle-click), perhaps because it's what I started on. Both have strange bugs that you eventually learn to work around. Both have lots of bells and whistles only advanced users will get to use. Hex-Rays' output feels much more polished to me. It recognizes a lot of compiler idioms, and every new release recognizes more. On the other hand, Hex-Rays only supports a few select platforms (when I started, it did 32-bit x86 only; now it does x86, x86-64, arm, aarch64, ppc, ppc64, mips), and you have to pay for it separately. Ghidra supports decompilation for almost all targets it can disassemble! This either is huge, or doesn't matter to you at all. Hex-Rays' support is amazing. You report a bug, include a specialized program database by means of a function in the GUI, and four hours later, you receive an email with the bug fixed. On the other hand, Ghidra is free and Hex-Rays is the most expensive software I've ever used, which is obviously a huge deal for anyone not doing this full-time. (The Hex-Rays license lasts for only a year, but after the license is expired, you can still use the software. You just don't get support or newer versions.) If Ghidra cost $500 (for a permanent license), I would probably consider getting it, but it happens to be $0. Fantastic value for money. If I could choose only one, and cost didn't matter? I'd probably go with Hex-Rays.
AsyncAwait 6y ago
So are we not concerned this is coming from the NSA anymore? Genuinely asking, as imo they wouldn't try to sneak something in the very first time it was released, all eyes were on them, but now?
- unnouinceput 6y ago
  Open source, so no, we're not.
  - dumpsterdiver 6y ago
    Sometimes the best place to hide something is in plain sight :)
    - hunter-gatherer 6y ago
      Of all the things on the NSA priority list, it seems like trying to inject malicious software into the wild via random reverse engineers computers seems like the best use of their time.
      - unnouinceput 6y ago
        open source means you can review the code. pretty sure, since this comes from them, is intensely scrutinized. So again, not worried.
- saagarjha 6y ago
  Generally, no. Consider that the people who use this tool are probably the best to find malicious things in it.
  - justaj 6y ago
    Except... isn't this a couple of million LoC? Doesn't the mere act of finding malicious things in it require some serious time and effort not likely to be accomplished by individuals?
gautamcgoel 6y ago
This is named after the three-headed dragon from the Godzilla cinematic universe, right?
- rockdiesel 6y ago
  I don’t think it is. King Ghidorah is the 3 headed monster from the Godzilla universe.
  - monkpit 6y ago
    Certainly seems like it is...
  - lanius 6y ago
    It's very possible. The Japanese pronunciation of hydra can be written as either Ghidorah (as seen in Godzilla) or Ghidra (as seen in Final Fantasy), among others, in English.
    - StavrosK 6y ago
      And the Greek pronunciation is "eedra", which has a lot fewer sounds than the above.
    - rockdiesel 6y ago
      Good to know. As a Godzilla fan, I didn’t know that. Thanks for the info.
- lanius 6y ago
  I strongly suspect that is the case, especially considering the logo :)
- curiousgal 6y ago
  "Ghidra" sounds like "غدر" which is Arabic for "treachery" which is funny since this was released by the NSA.
  - 6y ago
saagarjha 6y ago
Anyone know if there’s a changelog available anywhere?
- Jasper_ 6y ago
  https://ghidra-sre.org/releaseNotes_9.2.html#9_2 https://ghidra-sre.org/releaseNotes_9.2.html#9_2
  - saagarjha 6y ago
    This is a lot more complete than I needed it to be. Thanks :)
- deleted 6y ago
  [deleted]
29athrowaway 6y ago
Is there a repo for popular Ghidra scripts?
- mdaniel 6y ago
  I can't comment on its usefulness, but I know of https://github.com/AllsafeCyberSecurity/awesome-ghidra#readme https://github.com/AllsafeCyberSecurity/awesome-ghidra#readm...
dhanna 6y ago
I’m curious. Is Ghidra the state of the art? Does the NSA have something better internally?
- jhvkjhk 6y ago
  Non NSA employee don't know the answer. NSA employee can't answer. So I think this question will have no answer unless you join NSA.
- iib 6y ago
  As far as I recall, Ghidra was in Wikileaks' 7 NSA tools from 2013. If Wikileaks got the state of the art then, it means that the NSA had around 5 years until Ghidra was released to get something better.
- Alekhine 6y ago
  I don't think so. I remember reading that one reason they open-sourced it was that they didn't want to have to retrain every hacker they hired to use Ghidra instead of IDA or something else. They're probably holding stuff back, it's the NSA after all, but Ghidra is probably still their tool of choice.
- VistaBrokeMyPC 6y ago
  Ghidra itself is still what they use, they released it so that potential hires don't have to be retrained from IDA Pro. What they don't release, however, is Ghidra plug-ins. I'm sure they have a vast trove of plug-ins for specific reverse engineering they do, and probably some that check for known holes they can exploit.
retox 6y ago
It's likely that some others here have followed along with the old Flash based Lena tutorials at some point. Are there any modern resources in a similar vein? What I found fulfilling about them was that some (all?) sections talked you through reversing/keygenning actual applications, rather than simple CrackMes. I know there are projects from OWASP etc with a realistic site for learning web security, but I don't know any realistic installed software for teaching in the same style with multiple targets in the same package.

203 points by KindOne 6y ago

Previous discussion when it was announced back in 2019, with 400+ comments: https://news.ycombinator.com/item?id=19315273 https://news.ycombinator.com/item?id=19315273

zelly 6y ago

Still waiting for a built-in debugger like IDA has

29athrowaway 6y ago
Not built in, but useful: - edb (https://github.com/eteran/edb-debugger https://github.com/eteran/edb-debugger) - x64dbg (https://x64dbg.com https://x64dbg.com)
moonchild 6y ago
Radare2[0] has a debugger (among other things), and can integrate with ghidra's decompiler[1]. 0. https://rada.re/ https://rada.re/ 1. https://github.com/radareorg/r2ghidra https://github.com/radareorg/r2ghidra
molticrystal 6y ago
The latest news on that debugger is from a reply to an issue [0] on June 17th, 2020: >As @ryanmkurtz mentioned work is continuing on the debugger, it is a large job and there have been many issues that have come up, not the least of which is COVID. We would really like to give you a timeline, but I don't want to promise anything and not deliver in a timely manner. Dynamic analysis and easy integration of dynamic information is important to the Ghidra community as is evidenced in the thread. >IMHO, I would not hesitate to learn/use any tool, as the knowledge gained can always be ported to another tool. Time spent learning other debuggers, such as gdb or windbg, will not be wasted as the new Ghidra based debugger will be integrated with existing debuggers or have considerable overlap with their command sets and functionality. That said, if another tool fits your needs, use it. There are many great things about each RE tool and reasons to use or not use each. >Rest assured we are diligently working on the debugger and we think it will be worth the wait. We'll share information on features and release when we have solid timelines. >Thanks for using Ghidra in whatever way fits your work. Feel free to request features/improvements you see lacking and we and the community will try to address them. >We'll close the issue for now. -------------------------- Also from the What's New 9.2 release notes: >Dynamic Analysis Framework - Debugger >The debugger is very much still in progress. You may have seen some commits, in the Ghidra GitHub master branch, to get in sync with the debugger. Stay tuned for more on the Dynamic Analysis Framework soon after the 9.2 release. [0] https://github.com/NationalSecurityAgency/ghidra/issues/24#issuecomment-645425059 https://github.com/NationalSecurityAgency/ghidra/issues/24#i...
archgoon 6y ago
Have you tried https://github.com/bootleg/ret-sync https://github.com/bootleg/ret-sync ?

dx87 6y ago

For anyone looking to learn Ghidra and finding it a little overwhelming, a Ghidra book was recently released. I'm finding it very helpful so far. https://nostarch.com/GhidraBook https://nostarch.com/GhidraBook

huntsman 6y ago
I'd also highly recommend the training course slides that are included in the Ghidra distribution. The "Advanced" course especially covers some cool tricks and ways Ghidra is different from IDA/Binary Ninja.
29athrowaway 6y ago
A review of the Ghidra book https://maxkersten.nl/2020/09/13/a-review-of-the-ghidra-book/ https://maxkersten.nl/2020/09/13/a-review-of-the-ghidra-book...
sidewinder 6y ago
SANS FOR610: Reverse Engineering Malware also has updated content to teach Ghidra.
- nostoc 6y ago
  Unless it changed since it incorporated Ghidra, SANS FOR610 has a very shallow look into actual static reversing of native code. It's a good introduction but does not venture far.
tptacek 6y ago
Reprising a previous comment: this book is good, but fair warning that it's not, like, a fun read; it's like one of those books from the 1990s that explains every dialog box in Microsoft Word. It's an excellent reference, but if you're just getting started reversing, Eidad Eilam's _Reversing_ is still a good choice. Part of the reason I keep saying this is, if you've done reversing work with IDA or Hopper, you can fumble your way to productivity with Ghidra without a book. So: if Ghidra is completely greek to you, start maybe with fundamentals.
6y ago

0xquad 6y ago

Is there a database of already analyzed objects? For example, can I search on the sha256sum of my IoT device's firmware and see if someone else has done the heavy lifting?

mdaniel 6y ago
That would be awesome, like GhidraHub or something I'm not well versed in the legality of publishing those databases, as some discussions I've heard elsewhere treat them the same as the object code they annotate and thus it would be like publishing the .exe from Photoshop. I would guess it's possible to separate the annotations from the object code, similar to the way subtitle files are shared for the movies, but similar to a wrong subtitle file, it would take some doing to discover it and more doing to try and rescue the annotations if they could apply to a slightly different but still applicable binary
MyAltAccount 6y ago
No. I know IDA has a "Lumina" database. https://www.hex-rays.com/products/ida/lumina/ https://www.hex-rays.com/products/ida/lumina/ Someone has made a public "Lumina" database for IDA. https://lumen.abda.nl/ https://lumen.abda.nl/ If you don't have a legit copy of IDA, you can always pirate a copy and use that public "Lumina" server.
- Quarrel 6y ago
  V Nice. Thanks for the Lumen link.
- muldvarp 6y ago
  If there was any public documentation on the "Lumina" protocol, one could create a Ghidra plugin that interacts with the server. Sadly, I don't have a copy of IDA (and therefore cannot reverse engineer the protocol) and the author of lumen.abda.nl hasn't released the source code.
mhh__ 6y ago
I'm sure Ghidra's creator's have one

mettamage 6y ago

Currently, I don't get Ghidra that much. But I appreciate the decompiler. While it isn't perfect, it reverses simple functions to C like pseudo-code a lot faster than I can (not that I'm fast at that anyway). Combining it with the free version of IDA (the disassembler, not the decompiler of IDA) has helped me a lot with hackthebox.eu challenges :)

jcranmer 6y ago
I've never tried IDA Pro's decompiler, but my most recent experience with the Ghidra decompiler had me going back to my tried-and-true hand decompilation steps. (Admittedly, the function in question had a switch statement that had sparse and dense cases (with holes in the dense block!), which is definitely going to do a decent job of confusing native decompilers).
- mettamage 6y ago
  Oh dear, yea no switch statement when I needed to use it. A lot of byte/bit flipping.
- Sesse__ 6y ago
  I've used Hex-Rays (IDA Pro's decompiler); not full-time, but 100+ hours, including professionally. My information is a few years out of date, but I think most of it is still current. I've also used Ghidra (9.1) for maybe 50 hours or so. First, let me say: Both are leaps and bounds above _anything_ else out there. Stuff like Hopper is basically just assembler code in a different syntax; Hex-Rays and Ghidra are real, working, useful decompilers. Hex-Rays charges four-figure sums for single licenses, and it's because the product is utterly worth it if you do this kind of thing for a living (or at least was before Ghidra came along). I would estimate it speeds up reverse-engineering by 10x. There's a wonderful interactivity where the decompiler does all the boring book-keeping for you, and you keep feeding it info and it tells you stuff in return. Decompiling is often about figuring out data structures; both will infer a lot of struct types and sometimes even names based on usage and surrounding code. This is _so incredibly useful_. When you give a field a type or a name, it propagates throughout the program and gives you new understanding. Both products are weird and have arcane UIs. IDA/Hex-Rays feels more ergonomical to me, though (for instance, highlighting happens automatically instead of having to middle-click), perhaps because it's what I started on. Both have strange bugs that you eventually learn to work around. Both have lots of bells and whistles only advanced users will get to use. Hex-Rays' output feels much more polished to me. It recognizes a lot of compiler idioms, and every new release recognizes more. On the other hand, Hex-Rays only supports a few select platforms (when I started, it did 32-bit x86 only; now it does x86, x86-64, arm, aarch64, ppc, ppc64, mips), and you have to pay for it separately. Ghidra supports decompilation for almost all targets it can disassemble! This either is huge, or doesn't matter to you at all. Hex-Rays' support is amazing. You report a bug, include a specialized program database by means of a function in the GUI, and four hours later, you receive an email with the bug fixed. On the other hand, Ghidra is free and Hex-Rays is the most expensive software I've ever used, which is obviously a huge deal for anyone not doing this full-time. (The Hex-Rays license lasts for only a year, but after the license is expired, you can still use the software. You just don't get support or newer versions.) If Ghidra cost $500 (for a permanent license), I would probably consider getting it, but it happens to be $0. Fantastic value for money. If I could choose only one, and cost didn't matter? I'd probably go with Hex-Rays.

AsyncAwait 6y ago

So are we not concerned this is coming from the NSA anymore? Genuinely asking, as imo they wouldn't try to sneak something in the very first time it was released, all eyes were on them, but now?

unnouinceput 6y ago
Open source, so no, we're not.
- dumpsterdiver 6y ago
  Sometimes the best place to hide something is in plain sight :)
  - hunter-gatherer 6y ago
    Of all the things on the NSA priority list, it seems like trying to inject malicious software into the wild via random reverse engineers computers seems like the best use of their time.
    - unnouinceput 6y ago
      open source means you can review the code. pretty sure, since this comes from them, is intensely scrutinized. So again, not worried.
saagarjha 6y ago
Generally, no. Consider that the people who use this tool are probably the best to find malicious things in it.
- justaj 6y ago
  Except... isn't this a couple of million LoC? Doesn't the mere act of finding malicious things in it require some serious time and effort not likely to be accomplished by individuals?

gautamcgoel 6y ago

This is named after the three-headed dragon from the Godzilla cinematic universe, right?

rockdiesel 6y ago
I don’t think it is. King Ghidorah is the 3 headed monster from the Godzilla universe.
- monkpit 6y ago
  Certainly seems like it is...
- lanius 6y ago
  It's very possible. The Japanese pronunciation of hydra can be written as either Ghidorah (as seen in Godzilla) or Ghidra (as seen in Final Fantasy), among others, in English.
  - StavrosK 6y ago
    And the Greek pronunciation is "eedra", which has a lot fewer sounds than the above.
  - rockdiesel 6y ago
    Good to know. As a Godzilla fan, I didn’t know that. Thanks for the info.
lanius 6y ago
I strongly suspect that is the case, especially considering the logo :)
curiousgal 6y ago
"Ghidra" sounds like "غدر" which is Arabic for "treachery" which is funny since this was released by the NSA.
- 6y ago

saagarjha 6y ago

Anyone know if there’s a changelog available anywhere?

Jasper_ 6y ago
https://ghidra-sre.org/releaseNotes_9.2.html#9_2 https://ghidra-sre.org/releaseNotes_9.2.html#9_2
- saagarjha 6y ago
  This is a lot more complete than I needed it to be. Thanks :)
deleted 6y ago
[deleted]

29athrowaway 6y ago

Is there a repo for popular Ghidra scripts?

mdaniel 6y ago
I can't comment on its usefulness, but I know of https://github.com/AllsafeCyberSecurity/awesome-ghidra#readme https://github.com/AllsafeCyberSecurity/awesome-ghidra#readm...

dhanna 6y ago

I’m curious. Is Ghidra the state of the art? Does the NSA have something better internally?

jhvkjhk 6y ago
Non NSA employee don't know the answer. NSA employee can't answer. So I think this question will have no answer unless you join NSA.
iib 6y ago
As far as I recall, Ghidra was in Wikileaks' 7 NSA tools from 2013. If Wikileaks got the state of the art then, it means that the NSA had around 5 years until Ghidra was released to get something better.
Alekhine 6y ago
I don't think so. I remember reading that one reason they open-sourced it was that they didn't want to have to retrain every hacker they hired to use Ghidra instead of IDA or something else. They're probably holding stuff back, it's the NSA after all, but Ghidra is probably still their tool of choice.
VistaBrokeMyPC 6y ago
Ghidra itself is still what they use, they released it so that potential hires don't have to be retrained from IDA Pro. What they don't release, however, is Ghidra plug-ins. I'm sure they have a vast trove of plug-ins for specific reverse engineering they do, and probably some that check for known holes they can exploit.

retox 6y ago

It's likely that some others here have followed along with the old Flash based Lena tutorials at some point. Are there any modern resources in a similar vein? What I found fulfilling about them was that some (all?) sections talked you through reversing/keygenning actual applications, rather than simple CrackMes. I know there are projects from OWASP etc with a realistic site for learning web security, but I don't know any realistic installed software for teaching in the same style with multiple targets in the same package.