6 ms·

Ghidra is a lifesaver for legacy systems that have a bunch of home-spun executables that make bespoke things function and rotate out random technicians over the

Ghidra is a lifesaver for legacy systems that have a bunch of home-spun executables that make bespoke things function and rotate out random technicians over the years, when they fail it is a pain to figure out what they explicitly do, so reverse engineering them is sometimes the only option when a new tool needs to be built that does the same thing but without the parts that are deprecated. I hadn't seen this class before so I look forward to filling in my knowledge gaps around this software, thank you.

psychphysic 3y ago
I patched a bug in a router firmware and jailbroke another router using Ghidra (mostly but also binwalk). I have no business being able to do either, still both became weekend tasks using Ghidra. I've since played around with hopper, binary ninja and radare2. Fun!
- the_only_law 3y ago
  > I've since played around with hopper, binary ninja and radare2. Fun! Would you recommend any of those. I’ve only ever played with the limited free IDA and Ghidra.
  - psychphysic 3y ago
    Only Radare2 which is FOSS and also can use the Ghidra decompiler. It's also cool as hell to use if you use the command line UI (nurses?)
    - xvilka 3y ago
      You might want to check Cutter[1][2] also. Our release builds come with decompiler included. [1] https://cutter.re https://cutter.re [2] https://github.com/rizinorg/cutter https://github.com/rizinorg/cutter
      - psychphysic 3y ago
        Sorry I missed you out! I have used cutter. It may be a sore point but I have a niggling curiousity did cutter previously work with R2 and there was some beef?
        nereye 3y ago
        See "Why did you fork radare2?" [1] from the Rizin FAQ. For more details, see (well, listen to) the episode of the Unnamed Reverse Engineering podcast which covered Rizin/Cutter [2]. [1] https://rizin.re/posts/faq/ https://rizin.re/posts/faq/ [2] https://unnamedre.com/episode/45 https://unnamedre.com/episode/45
        xvilka 3y ago
        See also my answer in a different thread about technical differences between two: https://news.ycombinator.com/item?id=36399085 https://news.ycombinator.com/item?id=36399085
      - rootw0rm 3y ago
        there's a name I haven't seen in a minute, I'll have to check this out again
  - localplume 3y ago
    I'd recommend binary ninja if you're serious about reversing. Not that expensive for a personal license. Ghidra is nice, but being FOSS it will always be slightly worse then paid. It's fantastic for free, but not perfect. If reversing is part time/once a month/once every few months then its probably the best choice. Used it for a few years professionally. binja is my favorite and been using it for the last year or so. just an absolute pleasure to use and collaborate with. IMO the best of all these tools. vector35 are great to work with as well. plugin development is real nice too IDA pro is the worst. hexrays are plain awful to work with and its so overpriced. hopper haven't tried, but seems good. mac only though r2 is interesting. great if you only have a headless connection, but difficult. Learning curve is tough, and payoff isn't necessarily there. an alternative to ghidra if you want free but want to feel more l33t
    - saagarjha 3y ago
      > Ghidra is nice, but being FOSS it will always be slightly worse then paid. lol, you know this isn’t true :)
      - kernelbugs 3y ago
        This is a strange take for me to see, maybe OP doesn't have the context that the US government has been funding Ghidra development for years now (before ultimately open sourcing it), and will no doubt continue to do so for years to come. This is the software used by NSA and contractors to analyze malware. From a UI perspective I get that it's clunky, but from a capabilities perspective I doubt there is much lacking.
- Genghis_Khan 3y ago
  > I have no business being able to do either ... Why not?
  - circuit10 3y ago
    They probably mean Ghidra made it relatively easy despite them not having that much experience in it

psychphysic 3y ago

I patched a bug in a router firmware and jailbroke another router using Ghidra (mostly but also binwalk). I have no business being able to do either, still both became weekend tasks using Ghidra. I've since played around with hopper, binary ninja and radare2. Fun!

the_only_law 3y ago
> I've since played around with hopper, binary ninja and radare2. Fun! Would you recommend any of those. I’ve only ever played with the limited free IDA and Ghidra.
- psychphysic 3y ago
  Only Radare2 which is FOSS and also can use the Ghidra decompiler. It's also cool as hell to use if you use the command line UI (nurses?)
  - xvilka 3y ago
    You might want to check Cutter[1][2] also. Our release builds come with decompiler included. [1] https://cutter.re https://cutter.re [2] https://github.com/rizinorg/cutter https://github.com/rizinorg/cutter
    - psychphysic 3y ago
      Sorry I missed you out! I have used cutter. It may be a sore point but I have a niggling curiousity did cutter previously work with R2 and there was some beef?
      - nereye 3y ago
        See "Why did you fork radare2?" [1] from the Rizin FAQ. For more details, see (well, listen to) the episode of the Unnamed Reverse Engineering podcast which covered Rizin/Cutter [2]. [1] https://rizin.re/posts/faq/ https://rizin.re/posts/faq/ [2] https://unnamedre.com/episode/45 https://unnamedre.com/episode/45
      - xvilka 3y ago
        See also my answer in a different thread about technical differences between two: https://news.ycombinator.com/item?id=36399085 https://news.ycombinator.com/item?id=36399085
    - rootw0rm 3y ago
      there's a name I haven't seen in a minute, I'll have to check this out again
- localplume 3y ago
  I'd recommend binary ninja if you're serious about reversing. Not that expensive for a personal license. Ghidra is nice, but being FOSS it will always be slightly worse then paid. It's fantastic for free, but not perfect. If reversing is part time/once a month/once every few months then its probably the best choice. Used it for a few years professionally. binja is my favorite and been using it for the last year or so. just an absolute pleasure to use and collaborate with. IMO the best of all these tools. vector35 are great to work with as well. plugin development is real nice too IDA pro is the worst. hexrays are plain awful to work with and its so overpriced. hopper haven't tried, but seems good. mac only though r2 is interesting. great if you only have a headless connection, but difficult. Learning curve is tough, and payoff isn't necessarily there. an alternative to ghidra if you want free but want to feel more l33t
  - saagarjha 3y ago
    > Ghidra is nice, but being FOSS it will always be slightly worse then paid. lol, you know this isn’t true :)
    - kernelbugs 3y ago
      This is a strange take for me to see, maybe OP doesn't have the context that the US government has been funding Ghidra development for years now (before ultimately open sourcing it), and will no doubt continue to do so for years to come. This is the software used by NSA and contractors to analyze malware. From a UI perspective I get that it's clunky, but from a capabilities perspective I doubt there is much lacking.
Genghis_Khan 3y ago
> I have no business being able to do either ... Why not?
- circuit10 3y ago
  They probably mean Ghidra made it relatively easy despite them not having that much experience in it