4 ms·

Ghidra 11.0 Released

81 points by voxadam 3y ago

vkaku 3y ago
I'm glad they added LoongArch support in this one. Please add more Asian chips support please. Would also be great to add support for most filesystems used by contemporary phones, such as F2FS - and some other embedded ones such as QNX4 FS. Would be great to integrate Ghidra with ROM dumping tools as well, so that people can actually do research on what is shipped to their own devices.
- kjellsbells 3y ago
  Given Ghidra's sponsor, I would expect particularly strong support for mainline platforms used in the US (eg, Qualcomm, apple silicon, intel, ARM)...and curiously, but perhaps not talked about much, strong support for Chinese hardware, based on their leadership wanting to look at US' potential adversaries?
  - vkaku 3y ago
    Yeah, well - They should be looking at the hardware supported by the Linux kernels and our present day compilers, so they can look at software running on present day devices. Another way, like you said, is to focus on adversarial interoperability, so paying attention to formats which do not have a meaningful way to disassemble / patch today and could use this treatment - for ensuring that critical systems always have a fallback. This especially means figuring out the supply chain of chips and firmware and having ways to ensure all of them are auditable.
emj 3y ago
It has BSIM that can fuzzy-find what libraries are statically compiled, so you know what version of a library that might be compiled in and if there are changes to it. Interesting that it is not only local but you can use an elastic search for that, I am guessing NSA has a pretty big elastic cluster with just binaries of libraries.
- mycall 3y ago
  Github has a huge index of binaries of libraries too.
  - nn3 3y ago
    Pointer to that index? Quick google couldn't find it
sontek 3y ago
"Ghidra is a software reverse engineering (SRE) framework". Interesting attempt at using a fairly well known acronym for a different purpose.
- stevenhuang 3y ago
  Acronyms have different meanings in different domains. Within the domain of vulnerability research, SRE commonly refers to software reverse engineering.
boppo1 3y ago
What's the best course on getting started with Ghidra?
- _lvbh 3y ago
  Try “The Ghidra Book” [0] I’m still going through it myself https://www.ghidrabook.com https://www.ghidrabook.com
denysvitali 3y ago
> A new Golang String Analyzer which finds and marks up Golang strings so they display correctly in the decompiler Finally! Thanks!

81 points by voxadam 3y ago

I'm glad they added LoongArch support in this one. Please add more Asian chips support please. Would also be great to add support for most filesystems used by contemporary phones, such as F2FS - and some other embedded ones such as QNX4 FS. Would be great to integrate Ghidra with ROM dumping tools as well, so that people can actually do research on what is shipped to their own devices.

kjellsbells 3y ago
Given Ghidra's sponsor, I would expect particularly strong support for mainline platforms used in the US (eg, Qualcomm, apple silicon, intel, ARM)...and curiously, but perhaps not talked about much, strong support for Chinese hardware, based on their leadership wanting to look at US' potential adversaries?
- vkaku 3y ago
  Yeah, well - They should be looking at the hardware supported by the Linux kernels and our present day compilers, so they can look at software running on present day devices. Another way, like you said, is to focus on adversarial interoperability, so paying attention to formats which do not have a meaningful way to disassemble / patch today and could use this treatment - for ensuring that critical systems always have a fallback. This especially means figuring out the supply chain of chips and firmware and having ways to ensure all of them are auditable.

emj 3y ago

It has BSIM that can fuzzy-find what libraries are statically compiled, so you know what version of a library that might be compiled in and if there are changes to it. Interesting that it is not only local but you can use an elastic search for that, I am guessing NSA has a pretty big elastic cluster with just binaries of libraries.

mycall 3y ago
Github has a huge index of binaries of libraries too.
- nn3 3y ago
  Pointer to that index? Quick google couldn't find it

sontek 3y ago

"Ghidra is a software reverse engineering (SRE) framework". Interesting attempt at using a fairly well known acronym for a different purpose.

stevenhuang 3y ago
Acronyms have different meanings in different domains. Within the domain of vulnerability research, SRE commonly refers to software reverse engineering.

boppo1 3y ago

What's the best course on getting started with Ghidra?

_lvbh 3y ago
Try “The Ghidra Book” [0] I’m still going through it myself https://www.ghidrabook.com https://www.ghidrabook.com

denysvitali 3y ago

> A new Golang String Analyzer which finds and marks up Golang strings so they display correctly in the decompiler Finally! Thanks!