12 ms·
NSA Ghidra open-source reverse engineering framework
- _lvbh 2y agoNothing but praise for Ghidra. It’s very powerful and intuitive to use. I’m still stunned that the NSA contributed to the public for once
- Already__Taken 2y agowhat you don't want all their crypto libraries? As targeted as go, this is right up there.
- BSDobelix 2y ago>I’m still stunned that the NSA contributed to the public for once They contributed SELinux too and sponsored the TrustedBSD Project.
- phone8675309 2y agoAs good as SELinux and TrustedBSD are, I wouldn't expect them to be any sort of defense against the NSA. I wouldn't expect them to publish anything that they can't already own when they want to.
- BSDobelix 2y agoThe only thing that can protect you from state actors is a one-way data diode, and/or a complete air gap system with rigorous physical security AKA another state...and even then...spies ;)
- vsnf 2y agoYou might be familiar with NSA as an offensive agency interested in subverting security systems, but it's actually composed of two separate and often warring divisions, the second of which is defensive in nature and is interested in securing systems. It is this second division which has a history of contributing in good faith to security projects, public and otherwise.
- deleted 2y ago[deleted]
- willis936 2y agoWhich one is responsible for their bad faith, public, defensive contributions? https://en.wikipedia.org/wiki/Dual_EC_DRBG https://en.wikipedia.org/wiki/Dual_EC_DRBG
- robertlagrant 2y agoThat seems offensive.
- phone8675309 2y agoI thought the offensive part of the NSA was the part that was capturing encrypted Internet traffic to later decrypt.
- red-iron-pine 2y agooffensive, in the sense that breaking key cryptograph would allow them into (foreign) systems. defensive in the sense that the block access into (American gov & private sector) systems via things like SELinux
- deleted 2y ago[deleted]
- isomorphic- 2y agoThe NSA has contributed many things such as SELinux and more.
- lars_francke 2y agoThey also contributed Apache NiFi but that was much earlier: https://nifi.apache.org/ https://nifi.apache.org/
- mschuster91 2y agoGhidra is powerful. The only thing I miss is the ability to actually do versioned (=Git) collaboration, or at least to publish stuff to Github or whatever without needing to either host Ghidra Server myself or depend on someone else.
- xvilka 2y agoRizin[1]/Cutter[2] projects are stored like text files that work well with git, you could try those tools. [1] https://rizin.re https://rizin.re [2] https://cutter.re https://cutter.re
- mschuster91 2y agoHeh, that looks interesting. Thanks!
- self_awareness 2y agoRizin is a fork of radare2, so I guess mentioning the original would also be a nice thing to do: https://rada.re https://rada.re
- xvilka 2y agoTrue, though there's a huge difference how projects are stored in both: https://rizin.re/posts/introducing-projects/ https://rizin.re/posts/introducing-projects/
- self_awareness 2y agoI mean of course there are differencies, if they would be the same then there would be no point in the fork, right? :) Well, unless it was due to ideological reasons, I remember Rubocop (linter for Ruby) had some ideological forks at some point in time.
- doktrin 2y agoPurely out of ignorance - what's the context here? I'm not in this space, but afaik Ghidra was released years ago so I'm guessing this post was triggered by a recent development, but it's not clear what that might be.
- nrabulinski 2y agoAs someone who is in this space, I’m not aware of any recent major developments so it’s most likely someone just thought it’s cool and hasn’t been talked about on HN in sufficiently long
- Nevolihs 2y agoI'm confused too. I haven't seen anything in that link that might be new and justifies this random post.
- tyre 2y agoPeople can post things because it’s new to them!
- guessmyname 2y agoNothing new, just one of today’s lucky “Ten Thousand” → https://xkcd.com/1053/ https://xkcd.com/1053/
- sentrysapper 2y agoYesterday Joe Grand put up a video explaining how he used Ghidra to find the password generator pattern and helped someone recover 43 BTC. For some folks, that was probably their first time seeing Ghidra in action and I imagine it sparked the curiosity flame again.
- _xerces_ 2y agoPeople post random stuff on here all the time. Often it is just a Wikipedia link to some topic with no context, no discussion or anything. I think it is lazy karma whoring and it works because people upvote it if they know what it is an like it. I might go ahead and submit the Wiki page for Rust :)
- jonatron 2y agoI wonder how Hex-Rays IDA sales are doing since Ghidra was released. Edit: If anyone can read French accounts: https://consult.cbso.nbb.be/consult-enterprise/0873473914 https://consult.cbso.nbb.be/consult-enterprise/0873473914
- deleted 2y ago[deleted]
- fr4nkr 2y agoMost Ghidra discussion I see online boils down to whining that it's not IDA Pro, so, probably not bad.
- cess11 2y agoI think the effect on pirated debuggers might have been bigger. When I was young and dabbled in this space one fun part of the experience was finding a cracked version of Olly that didn't have custom trojans in it. I'm sure this tradition continued after I sort of dropped out, at least until Ghidra and WinDbg and low-threshold gdb-facades made it less relevant.
- self_awareness 2y agoCracked versions of OllyDbg? Wasn't OllyDbg always free?
- cess11 2y agoNah, it was shareware at first.
- self_awareness 2y agoV1 is still shareware, but wasn't it always free to use? I mean, not that it matters in the long run, now I guess Olly was superseded by x64dbg anyway, but as a person who migrated from SoftICE to Olly, I've never had to find a cracked version for it. But the again, I was one of those "last men standing" when it came to migration, so I could migrate relatively late compared to others.
- ur-whale 2y agoGhidra is an amazing tool, and indeed the fact that the NSA contributed this to the public is amazing, but understandable if your goal is to enhance cyber-security: it is the perfect swiss knife to figure out if there's nasty things embedded in binary blobs. The one thing I would love to see come to Ghidra is an ML powered assistant that adds two features: - AI-powered automated, semantically relevant, routine and variable naming - AI-powered compiler recognition and improved recovery of loop structure Both things should be possible using LLMs and the fact that compilers can be used to generate an infinite size training set for almost free.
- cyberpunk 2y agoThere are plugins which do this already. Bring your own openai license.
- red-iron-pine 2y agohope you're not doing something that ChatGPT would be able to catalog and resell...
- FL33TW00D 2y agoCan we put a date on this? I was in undergrad when this was released.
- gchq-7703 2y agoThis was released March 2019 as part of the RSA conference[0] [0] https://www.rsaconference.com/Library/presentation/USA/2019/come-get-your-free-nsa-reverse-engineering-tool-3 https://www.rsaconference.com/Library/presentation/USA/2019/...
- a2800276 2y agoCan we put a date on this, I have no idea when you were an undergrad. ;)
- rgovostes 2y agoNSA Ghidra open-source reverse engineering framework (c. 2017-2020)
- boricj 2y agoI'm developing my own Ghidra extension that can export object files out of a program selection: https://github.com/boricj/ghidra-delinker-extension https://github.com/boricj/ghidra-delinker-extension Ghidra's data model, analyzers and UI gave me a framework that allowed me to experiment and focus on the specifics of delinking, which is the key to make this idea work. Without that, I would not have been able to pull it off and I would've given up on my decompilation project a long time ago, for lack of a means to divide and conquer it.
- sentrysapper 2y agoJoe Grand's latest video shows a clever usage of Ghidra to understand insecure password generator methods and recover lost BTC. https://youtu.be/o5IySpAkThg?si=EGhF7Jf01G6nQPL9 https://youtu.be/o5IySpAkThg?si=EGhF7Jf01G6nQPL9
- c0wb0yc0d3r 2y agoMaybe I missed it but it seems like he used it like anyone familiar with reverse engineering would? The video just shows the use of the decompiler, briefly, right?
- sentrysapper 2y agoPerhaps, I've just never seen Ghidra used like this. For me, the clever part was putting together that the password generator method used time. Then putting together a wrapper app to batch produce passwords from the timeframe the client would have generated the passwords.
- kebman 2y agoJust looking at what AI can do with a simple error message should tell you heaps and bounds how much help it could be in analysis for reverse engineering.
- broodbucket 2y agoI just can't stand Ghidra's UI. Trying to get it to look nice, at least on Linux with HiDPI, is such a chore. These Eclipse-y GUIs have aged like milk
- boricj 2y agoYou can tweak the arguments given to the JVM by editing the support/launch.properties file. In particular, you can change the UI scale with the sun.java2d.uiScale property, which is set by default to 1.
- dmw_ng 2y ago> Linux with HiDPI, is such a chore There's a simple broad-spectrum fix for that. For the odd occasion I want to view high definition photos in Linux I just switch screen mode temporarily, for the rest it is sooo not worth the hassle
- kernal 2y agoGhidra uses Swing, which is almost the exact opposite of what Eclipse uses (SWT). Swing can be made to look very nice as shown by these demos: https://www.jgoodies.com/downloads/demos/ https://www.jgoodies.com/downloads/demos/ Ghidra could use a Swing refresh, but its UI/UX has more to do with the lack of a UI/UX designer than Swing itself. Additionally, all of IntelliJ products use Swing and I consider their UI's to be beautiful. So, it's not the UI toolkit, but rather the implementation.
- mdaniel 2y agoHeh, they offer a Java WebStart link - for the 10 people still running Netscape on WinXP I guess :-D Cheekiness aside, I did find their .jnlp handy for getting the right invocation args java --add-exports=java.desktop/com.sun.java.swing.plaf.windows=ALL-UNNAMED -Djnlp.packEnabled=true -jar smart-client-showcase-24.04.0.jar
- tutipop 2y agoWhat's the history of the name? Ghidra sounds Russian (Гидра) for Hydra. Was it considered cool to use Russian words for hacker/spy things?
- kryptiskt 2y agoGhidra is a monster from the Godzilla movies. I don't know if it's some Japanese version of "Hydra".
- red-iron-pine 2y ago> Please remember that the NSA is run by a bunch of nerds and Ghidorah in Japanese cinema is a movie about a three headed monster. In the film, an extraterrestrial from Venus, possessing the body of a princess, warns humanity of the pending destruction by the alien-dragon King Ghidorah-with Godzilla, Rodan, and Mothra being their last hope for survival.
- superdisk 2y ago> The "Ghidorah" part of King Ghidorah's name comes from the pronunciation of the word "hydra" (Гидра, ˈɡʲidrɐ) in Russian, written as ヒドラ (Hidora) in Japanese. Good eye, looks like the name does originate from that.
- deleted 2y ago[deleted]