8 ms·

Debugger Ghidra Class

199 points by simonpure 3y ago

remram 3y ago
Oh it's "class" as in "lesson", not OOP. Since it's a link to GitHub, somehow I expected the latter (a plugin in some NSA tool?), but this is much more interesting.
T3RMINATED 3y ago
[dead]
_benj 3y ago
This looks very interesting! Question: looks like Ghidra can be used as a GDB "interface", is that correct?
- t20230619 3y ago
  Yes. Actually, the OP is all about driving gdb from Ghidra. It is only one part of the larger "Ghidra Class" (see repo's parent folder). The parts are: - Beginner - Intermediate - Advanced - AdvancedDevelopment - Debugger (the OP) - ExerciseFiles
t20230619 3y ago
I have a good experience with Cutter (Rizin's official GUI). Anyone can comment on the functionality difference between the two? Any advantages to using Ghidra directly? I must confess that when starting out I opted for Cutter just because of Ghidra's JVM dependency. But this is only due to old scars and my aversion to installing Java is probably outdated now. (I am not the only one though: Cutter can also use Ghidra's decompiler component, and its website proudly adds "no Java involved".)
- 36933 3y ago
  Yeah there must be a reason why „nobody“ is using Cutter, interested in that as well.
  - c-c-c-c-c 3y ago
    Probably because noone wants to user rizin when you can use radare2. :-)
    - MuffinFlavored 3y ago
      What about x64dbg? Is that considered the standard on Windows?
    - _benj 3y ago
      I'm still fuzzy on the difference between the two, would you mind to elaborate?
      - xvilka 3y ago
        There are many different technical differences that accumulated over time - we save projects as a state snapshot, not a sequence of commands[1], we save types as semantically connected structures in a database that is guaranteed to be consistent[2], use better stack tracking for arguments and variables[3], not SP/BP/whatever, slowly migrate to a new generation of IL - RzIL instead of ESIL[4], provide standard libraries signatures out of the box in the FLIRT format[5], switched to a new way of parsing and processing commands[6], provide basefind, and many other small differences. [1] https://rizin.re/posts/introducing-projects/ https://rizin.re/posts/introducing-projects/ [2] https://github.com/rizinorg/rizin/tree/dev/librz/type https://github.com/rizinorg/rizin/tree/dev/librz/type [3] https://github.com/rizinorg/rizin/releases/tag/v0.5.0 https://github.com/rizinorg/rizin/releases/tag/v0.5.0 [4] https://github.com/rizinorg/rizin/blob/dev/doc/rzil.md https://github.com/rizinorg/rizin/blob/dev/doc/rzil.md [5] https://github.com/rizinorg/sigdb https://github.com/rizinorg/sigdb [6] https://rizin.re/posts/rzshell/ https://rizin.re/posts/rzshell/
  - saagarjha 3y ago
    Other options are typically more fully-baked and conventional.
- Llamamoe 3y ago
  What are Rizin and Cutter, and what value do they offer over Ghidra?
status200 3y ago
Ghidra is a lifesaver for legacy systems that have a bunch of home-spun executables that make bespoke things function and rotate out random technicians over the years, when they fail it is a pain to figure out what they explicitly do, so reverse engineering them is sometimes the only option when a new tool needs to be built that does the same thing but without the parts that are deprecated. I hadn't seen this class before so I look forward to filling in my knowledge gaps around this software, thank you.
- psychphysic 3y ago
  I patched a bug in a router firmware and jailbroke another router using Ghidra (mostly but also binwalk). I have no business being able to do either, still both became weekend tasks using Ghidra. I've since played around with hopper, binary ninja and radare2. Fun!
  - the_only_law 3y ago
    > I've since played around with hopper, binary ninja and radare2. Fun! Would you recommend any of those. I’ve only ever played with the limited free IDA and Ghidra.
    - psychphysic 3y ago
      Only Radare2 which is FOSS and also can use the Ghidra decompiler. It's also cool as hell to use if you use the command line UI (nurses?)
      - xvilka 3y ago
        You might want to check Cutter[1][2] also. Our release builds come with decompiler included. [1] https://cutter.re https://cutter.re [2] https://github.com/rizinorg/cutter https://github.com/rizinorg/cutter
        psychphysic 3y ago
deleted 3y ago
[deleted]
codetrotter 3y ago
From the title I was first expecting some kind of educational material, but then I saw the link and knowing that Ghidra itself is for the most part written in Java I thought then that it would be about Java internals used by the debugger portion of Ghidra. Happy to learn that it is indeed educational material as I have only scratched the surface of Ghidra myself and have a lot to learn about it.
- rgovostes 3y ago
  I hope they continue to produce new training material, perhaps using some kind of GhidraClassFactory.

199 points by simonpure 3y ago

Oh it's "class" as in "lesson", not OOP. Since it's a link to GitHub, somehow I expected the latter (a plugin in some NSA tool?), but this is much more interesting.

T3RMINATED 3y ago

[dead]

_benj 3y ago

This looks very interesting! Question: looks like Ghidra can be used as a GDB "interface", is that correct?

t20230619 3y ago
Yes. Actually, the OP is all about driving gdb from Ghidra. It is only one part of the larger "Ghidra Class" (see repo's parent folder). The parts are: - Beginner - Intermediate - Advanced - AdvancedDevelopment - Debugger (the OP) - ExerciseFiles

t20230619 3y ago

I have a good experience with Cutter (Rizin's official GUI). Anyone can comment on the functionality difference between the two? Any advantages to using Ghidra directly? I must confess that when starting out I opted for Cutter just because of Ghidra's JVM dependency. But this is only due to old scars and my aversion to installing Java is probably outdated now. (I am not the only one though: Cutter can also use Ghidra's decompiler component, and its website proudly adds "no Java involved".)

36933 3y ago
Yeah there must be a reason why „nobody“ is using Cutter, interested in that as well.
- c-c-c-c-c 3y ago
  Probably because noone wants to user rizin when you can use radare2. :-)
  - MuffinFlavored 3y ago
    What about x64dbg? Is that considered the standard on Windows?
  - _benj 3y ago
    I'm still fuzzy on the difference between the two, would you mind to elaborate?
    - xvilka 3y ago
      There are many different technical differences that accumulated over time - we save projects as a state snapshot, not a sequence of commands[1], we save types as semantically connected structures in a database that is guaranteed to be consistent[2], use better stack tracking for arguments and variables[3], not SP/BP/whatever, slowly migrate to a new generation of IL - RzIL instead of ESIL[4], provide standard libraries signatures out of the box in the FLIRT format[5], switched to a new way of parsing and processing commands[6], provide basefind, and many other small differences. [1] https://rizin.re/posts/introducing-projects/ https://rizin.re/posts/introducing-projects/ [2] https://github.com/rizinorg/rizin/tree/dev/librz/type https://github.com/rizinorg/rizin/tree/dev/librz/type [3] https://github.com/rizinorg/rizin/releases/tag/v0.5.0 https://github.com/rizinorg/rizin/releases/tag/v0.5.0 [4] https://github.com/rizinorg/rizin/blob/dev/doc/rzil.md https://github.com/rizinorg/rizin/blob/dev/doc/rzil.md [5] https://github.com/rizinorg/sigdb https://github.com/rizinorg/sigdb [6] https://rizin.re/posts/rzshell/ https://rizin.re/posts/rzshell/
- saagarjha 3y ago
  Other options are typically more fully-baked and conventional.
Llamamoe 3y ago
What are Rizin and Cutter, and what value do they offer over Ghidra?

status200 3y ago

Ghidra is a lifesaver for legacy systems that have a bunch of home-spun executables that make bespoke things function and rotate out random technicians over the years, when they fail it is a pain to figure out what they explicitly do, so reverse engineering them is sometimes the only option when a new tool needs to be built that does the same thing but without the parts that are deprecated. I hadn't seen this class before so I look forward to filling in my knowledge gaps around this software, thank you.

psychphysic 3y ago
I patched a bug in a router firmware and jailbroke another router using Ghidra (mostly but also binwalk). I have no business being able to do either, still both became weekend tasks using Ghidra. I've since played around with hopper, binary ninja and radare2. Fun!
- the_only_law 3y ago
  > I've since played around with hopper, binary ninja and radare2. Fun! Would you recommend any of those. I’ve only ever played with the limited free IDA and Ghidra.
  - psychphysic 3y ago
    Only Radare2 which is FOSS and also can use the Ghidra decompiler. It's also cool as hell to use if you use the command line UI (nurses?)
    - xvilka 3y ago
      You might want to check Cutter[1][2] also. Our release builds come with decompiler included. [1] https://cutter.re https://cutter.re [2] https://github.com/rizinorg/cutter https://github.com/rizinorg/cutter
      - psychphysic 3y ago

deleted 3y ago

[deleted]

codetrotter 3y ago

From the title I was first expecting some kind of educational material, but then I saw the link and knowing that Ghidra itself is for the most part written in Java I thought then that it would be about Java internals used by the debugger portion of Ghidra. Happy to learn that it is indeed educational material as I have only scratched the surface of Ghidra myself and have a lot to learn about it.

rgovostes 3y ago
I hope they continue to produce new training material, perhaps using some kind of GhidraClassFactory.