12 ms·

Ghidra by NSA

433 points by handfuloflight 9mo ago

xvilka 9mo ago
Cutter[1] by RizinOrg[2]. [1] https://github.com/rizinorg/cutter https://github.com/rizinorg/cutter [2] https://github.com/rizinorg/rizin https://github.com/rizinorg/rizin
- aktau 9mo ago
  +1 I once tried learning how to RE with radare2 but got very frustrated by frequent project file corruption (meaning radare2 could no longer open it). The way these project files work(ed?) in radare2 at the time was that it just saved all the commands you executed, instead of the state. This was brittle, in my experience. I don't have a lot of free time, so I have to leave projects for long periods of time, not being able to restart from a previous checkpoints meant I never actually got further. IIUC, one of the first things Rizin did was focus on saving the actual state, and backwards/forwards-compatibility. This fact alone made me switch to Rizin. To its credit, my 3-year old project file still works! Now for the downside: there is apparently a gap in Windows (32-bit) PE support, causing stack variables to be poorly discovered: https://github.com/rizinorg/rizin/issues/4608 https://github.com/rizinorg/rizin/issues/4608. I tested this on radare2, which does not have this bug. I'm hoping this gets fixed in Rizin at some point, at which point I'll continue my RE adventure. Or maybe I should give an AI reverse engineer a try... (https://news.ycombinator.com/item?id=46846101 https://news.ycombinator.com/item?id=46846101).
  - xvilka 9mo ago
    Yes, we are working on rewriting analysis completely[1][2] that would fix your issue along with many others. [1] https://github.com/rizinorg/rizin/pull/5505 https://github.com/rizinorg/rizin/pull/5505 [2] https://github.com/rizinorg/rizin/issues/4736 https://github.com/rizinorg/rizin/issues/4736
    - aktau 9mo ago
      Can't wait! Do you have any idea how far along this is? Is it likely to be months, quarters, years? (Funny expression, that. I'll wait, of course. It'll be a happy day when this works again and I can slowly make progress RE'ing again.)
      - xvilka 9mo ago
        Months.
  - alberto-m 9mo ago
    I tried radare2 with the official GUI Iaito. Iaito saves the project in a git repo, so whenever I got corruption (and I got it a lot, like every 4-5 saves) I was just a `git reset --hard` away from restoring a good state. Not the most efficient way of operation, but for me it was better this than tolerating Ghidra's tiny Courier New font.
    - aktau 9mo ago
      Thanks for the note. Your corruption frequency anecdote matches mine. I don't have the mental werewithal to deal with that. I won't go back to radare2 until they change their project file stability somehow.
mturk 9mo ago
Ghidra is a very impressive piece of software with a deep bench of functionality. The recent couple major releases that move to a more integrated Python experience have been very nice to use.
atemerev 9mo ago
I always wondered whether they have a much more capable internal version. And I wonder the same thing for AI labs (they have to do a lot of lobotomy for their models to be ready for public use... but internally, they can just skip this perhaps?)
- jacquesm 9mo ago
  Too many people in the know about this stuff I think to keep it hidden for that long. At the same time, we keep finding stuff that that should have held for and it didn't, so maybe you're right.
- bjackman 9mo ago
  Very likely people who actually work on RE at the NSA also have access to IDA Pro licenses. I don't work in this space, so take it with a pinch of salt, but my understanding is this is a fairly long term strategic initiative to _eventually_ be the best tool.
  - 19h 9mo ago
    Ghidra has a slightly different focus than IDA, so they're definitely not just using Ghidra :-)
    - sergent_moon 9mo ago
      I have only a very basic understanding of the two tools. Can you give me just some highlights regarding their differences?
      - 19h 9mo ago
        Well, Ghidra's strength is batch processing at scale (which is why P-Code is less accurate than IDA's but still good enough) while allowing a massive amount of modules to execute. That allows huge distributed fleets of Ghidra. IDA has idalib now, and hcli will soon allow batch fleets, but IDA's focus is very much highly accurate analysis (for now), which makes it a lot less scalable performance wise (for now).
zeon256 9mo ago
Been awhile since I used this but decided to open the latest version to check my rust binary and was pleasantly surprised how much better it is today wrt rust binaries
- flipped 9mo ago
  Can you be more specific? Is it getting easier to reverse rust and go, since I have read about it being the hardest to reverse.
  - quux0r 9mo ago
    It's not perfect, but in my personal experience it is still tough in languages like that due to the sheer volume of indirection and noise that makes it hard to follow. For example Go's calling convention is a little nutty compared to other languages, and you'll encounter a few *****ppppppppVar values that are otherworldly to make sense of, but the ability to recognize library functions and sys calls is for sure better.
systems 9mo ago
is ghidralite dot com a safe link or an official link when i try to expand their faq, it seem to try an open a (presumabl) malicious link , i wont paste the link here just in case it is really malicious
- staubfinger 9mo ago
  Just use the official github link or links that are linked there. The URL you mentioned seems bogus at best.
  - waltbosz 9mo ago
    Curious, the ghidralite page download button links to the NSA's github releases page. I wonder what is the purpose of ghidralite dot com. SEO spam? Are they building trust and then will swap out the Download button with a poisoned binary.
    - h4ch1 9mo ago
      Or climb up high enough in the search results and sell the domain to a malicious actor.
- dizzy9 9mo ago
  Looks like AI slop and SEO junk. The Guide page you linked opens with an article on Dubai sports car rental. There are also .net and .org variants of the domain, which appear to be also AI-generated slop. There's no such program as Ghidralite, and every site just links to the official Ghidra repository.
jeevacation 9mo ago
[flagged]
- 13hunteo 9mo ago
  You have a disgusting username
  - flipped 9mo ago
    You're just giving the troll an audience by reacting to it.
  - jeevacation 9mo ago
    [dead]
jeevacation 9mo ago
[flagged]
- reactordev 9mo ago
  No. Cheat engine scans memory as a program is running, for values of interest to pin (or modify). Allowing you to change behavior. Ghidra takes a program and unravels the machine code back into assembly and thus, something resembling C code. Allowing you to change behavior. Cheat Engine doesn’t modify the binary. Ghidra can.
  - kaibee 9mo ago
    > Cheat Engine doesn’t modify the binary. Ghidra can. To clarify for other people who may not be familiar, (though I'm far from an expert on it myself) you can inject/modify asm of a running binary with CE. I'm not sure if there's a way to bake the changes to the exe permanently.
mdavid626 9mo ago
Works well. I used this tool once to disassemble and understand how key manager works on Vivotek cameras. They create executables, which contain encrypted binary data. Then, when the executable runs, it decodes the encrypted data and pipes it into "sh". The security is delusional here - the password is hard coded in the executable. It was something like "VIVOTEK Inc.". Ghidra was able to create the C code and I was able to extract also the binary data to a file (which is essentially the bash script).
- mickeyp 9mo ago
  Sounds like `strings' on the binary would've sufficed if it's just hardcoded.
  - mdavid626 9mo ago
    No, that’s not enough. The password would be visible, but the encyption algorithm and the script’s text wouldn’t.
yibers 9mo ago
Can anyone provide their opinion of Ghidra vs Ida? Is Ida worth the extra money?
- q3k 9mo ago
  IDA is the better tool if you're being paid to work with architectures that IDA supports well (ARM(64), x86(_64), etc). This usually means 'mainstream' security/malware research. It's not worth the price for hobbyists. Before Hex-Rays was sold to private equity, it could make sense for rich hobbyists to pay for a private license once and use it for a few years without software updates, with the cloud offering now it pretty much makes no sense. Ghidra is the better tool if you're dealing with exotic architectures, even ones that you need to implement support for yourself. That's because any architecture that you have a full SLEIGH definition for will get decompilation output for free. It might not be the best decompiler out there, sure, but for some architectures it's the only decompiler available. Both are generally shit UX wise and take time to learn. I've mostly switched from IDA to Ghidra a while back which felt like pulling teeth. Now when I sometimes go back to IDA it feels like pulling teeth.
  - 19h 9mo ago
    Which exotic architectures is IDA missing from your perspective?
    - q3k 9mo ago
      Stuff I've recently analyzed that IDA has no decomp support for (and Ghidra's is anywhere from good enough to actually good): - AVR - Z80 - HC08 - 8051 - Tricore - Xtensa - WebAssembly - Apple/Samsung S5L87xx NAND controller command sequencer VLIW (custom SLEIGH) And probably more that I've forgotten. It's also not about lack of support, but the fact that you have to pay extra for every single decompiler. This sucks if you're analyzing a wide variety of targets because of the kind of work you do. IDA also struggles with disasm for Harvard architectures which tend to make up a bulk of what I analyze - it's all faked around synthetic relocations. Ghidra has native support for multiple address spaces.
palata 9mo ago
Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an experienced developer, but not so experienced in reverse engineering? I guess one issue I have is that I don't have good ideas of fun projects, and that's probably something I need to actually get the motivation to learn. I can find a "hello world", that's easy, but it won't help me get an idea of what I could reverse engineer in my life. For instance I have a smartspeaker that I would like to hack (being able to run my own software on it, for fun), but I don't know if it is a good candidate for reverse engineering... I guess I would first need to find a security flaw in order to access the OS? Or flash my own OS (hoping that it's a Linux running there), but then I would probably want to extract binary blobs that work with the buttons and the actual speaker?
- gray_charger 9mo ago
  You can start here to learn reverse engineering. https://beginners.re/ https://beginners.re/
- 0x54MUR41 9mo ago
  If you are into the book, I would recommend The Ghidra Book from No Starch publisher https://nostarch.com/ghidra-book-2e https://nostarch.com/ghidra-book-2e. The book is designed for beginner and advance users.
- quux0r 9mo ago
  So a couple things. Bruce Dang’s book, while a little old, is still a great spot to get started. Another great book is Blue Fox by Maria Markstedter for ARM. From there, finding small binaries and just trying to get the “flow” is a good next step, for me this is largely renaming functions and variables and essentially trying to work the decompiled code into something readable, then you can find flaws. So for the second thing, pulling the data off chips like that typically involves some specialized hardware, and you have to potentially deal with a bunch of cryptographic safeguards to read from the chip’s memory. Not impossible though, and there are not always good safeguards, but might be worth checking out some simpler programs and working up to it, or learning some basic hardware hacking to get an idea of how that process works.
quux0r 9mo ago
While on the topic, I want to highlight two incredible plugins for Ghidra: https://github.com/jtang613/GhidrAssist https://github.com/jtang613/GhidrAssist And https://github.com/jtang613/GhidrAssistMCP https://github.com/jtang613/GhidrAssistMCP Being able to hook Claude code up to this has made reversing way more productive. Highly recommend!
- tomasphan 9mo ago
  How willing is Claude to help you there?
  - quux0r 9mo ago
    It's actually pretty good. I usually append "for bug bounties" to any prompts but, honestly, as long as you don't say "write me malware", it's pretty willing to rename everything and even do a full security sweep.
- mixologic 9mo ago
  A friend of mine has also been working on a Ghidra MCP: looks like theres a few of them: https://github.com/themixednuts/GhidraMCP https://github.com/themixednuts/GhidraMCP
- nazgulsenpai 9mo ago
  https://github.com/LaurieWired/GhidraMCP https://github.com/LaurieWired/GhidraMCP is great also
  - GlumWoodpecker 9mo ago
    The author of this has an excellent tech YouTube channel: https://www.youtube.com/@lauriewired https://www.youtube.com/@lauriewired
    - hugh-avherald 8mo ago
      Bit advanced for Hacker News folks I think.
flipped 9mo ago
[flagged]
- sabas123 9mo ago
  Without providing any proof that either this or SELinux is backdoored.
- LPisGood 9mo ago
  Well it’s open source, so you can check in principle. I would imagine there’s some fame and notoriety in discovering that.
- dizzy9 9mo ago
  This was discussed when Ghidra was first open sourced. To the best of my knowledge, nobody's found an NSA backdoor in Ghidra.
- jandrese 9mo ago
  Seems like it would be of limited value to backdoor a program like Ghidra. Might be useful in identifying security researchers, except that it's also the kind of program that will often be running on disconnected systems with little valuable data beyond whatever is being disassembled.
alexrp 9mo ago
Binary Ninja deserves a mention in these threads: https://binary.ninja https://binary.ninja I've used IDA, Ghidra, and Binary Ninja a lot over the years. At this point I much prefer Binary Ninja for the task of building up an understanding of large binaries with many thousands of types and functions. It also doesn't hurt that its UI/UX feel like something out of this century, and it's very easy to automate using Python scripts.
- xvilka 9mo ago
  In particularly I like their approach of creating modern IR pipeline.
- capl 9mo ago
  Binary Ninja seems way ahead in terms of UX, as a hobby reverser. It's my default as well.
  - zo1 9mo ago
    It's basically "VS Code" UX with dark mode. Come on, is this some sort of joke? Serious question.
    - EE84M3i 9mo ago
      Last time I used them - Ghidra, and to some extent IDA, had UXes that were very difficult for new users to pick up and frequently deviate from standard expectations for modern desktop apps because they have two decades of baggage. In contrast binary ninja is very easy to explore and has many fewer surprises.
    - psifertex 9mo ago
      I'm curious what you would consider better UX? We have actually been more inspired by Jetbrains lately than VS Code. Take that for what you will. We do try to pick simple sane defaults while still allowing enough customization to adapt to different workflows. Actually working on a startup wizard for first time users if they want to more closely replicate the feel of other RE tools since muscle memory is hard to break.
jakozaur 9mo ago
Funny thing, AI is not that terrible at using Ghidra. We released a benchmark on that and hopefully models will improve: https://quesma.com/blog/introducing-binaryaudit/ https://quesma.com/blog/introducing-binaryaudit/
- Alifatisk 9mo ago
  There is MCPs for Ghidra
  - joe_mamba 9mo ago
    Yeah this. I saw some guys on youtube use AI MCPs to do some crazy reverse engineering. It's difficult to be an AI doomer when you see stuff like this.
    - thenaturalist 9mo ago
      Would you have a link / links or hints about the channel?
    - le-mark 9mo ago
      “AI Doomer” is ambiguous here! Do you mean someone who optimistic about ai will never amount to anything, or that ai won’t be the end of humanity?
Supermancho 9mo ago
I first used Ghidra this weekend as part of this series: https://www.youtube.com/watch?v=d7qVlf81fKA&list=PL4X0K6ZbXhIMcLiddydGAPKynJRVjtyv- https://www.youtube.com/watch?v=d7qVlf81fKA&list=PL4X0K6ZbXh... (#3 forward uses Ghidra) It worked fine in Ubuntu and Windows. The interface takes some getting used to, but paired with Bless Unofficial (using snap to install), it makes reverse engineering smooth.
commandersaki 9mo ago
Awful to use with a tiling window manager.
stared 9mo ago
Awesome soft! It works surprisingly nicely with AI agents (I mean, like Cursor or Claude Code, I don't let it run autonomously!). Here on detecting malware in binaries (https://quesma.com/blog/introducing-binaryaudit/ https://quesma.com/blog/introducing-binaryaudit/). I am now in process of recompiling and old game Chromatron, from PowerPC binary to Apple Silicon and WASM (https://p.migdal.pl/chromatron-recompiled/ https://p.migdal.pl/chromatron-recompiled/, ready to play, might be still rough edges).
Alifatisk 9mo ago
There is also Hopper for ObjC/Swift, haven't tried it personally though https://www.hopperapp.com https://www.hopperapp.com
- saagarjha 9mo ago
  Hopper is pretty but worse than Ghidra for both
29athrowaway 9mo ago
OllyDbg inspired: https://github.com/eteran/edb-debugger https://github.com/eteran/edb-debugger
jevinskie 9mo ago
Is it just me or is the merge style used for the repo very difficult to follow? Am I holding it wrong?
mahaloz 9mo ago
Since we’re talking about decompilers, might as well mention the community around the research area: http://decompilation.wiki/ http://decompilation.wiki/ As well as the research history (slated to be updated in a few days): https://mahaloz.re/dec-progress-2024 https://mahaloz.re/dec-progress-2024
- Melonai 9mo ago
  Agh I really wish these awesome community wikis would be easier to find when you don't know about them, they usually have such a cool trove of information. The one I love quite I love is the OSDev Forums Wiki, though that one is well known and loved by a lot of people in the space. We really need to protect these projects somehow, more and more stuff and expertise is getting hidden in Discord servers, completely unsearchable and locked away within the minds of the members...
maximalthinker 9mo ago
[dead]
ambitious_whale 9mo ago
What does it do I don't understand a think can someone explain me
lacoolj 9mo ago
Posting this on Github is a brilliant move by the NSA, and it showing up on HN amplifies it even more. It's certainly not the first thing they've released (selinux, for one, and then all the other repos in the account), but this repo showing up on HN, with a prominent call-to-action to look at a career with them, is a great way to target the applicants you want ("those who would find this project interesting, because it's just the sort of thing we need them to work on") Atlassian used to do (maybe still does) this in bitbucket if you open dev tools - a link to their careers page shows up
deleted 9mo ago
[deleted]
kugutsumen 9mo ago
unflutter supports ghidra :) https://news.ycombinator.com/item?id=47035788 https://news.ycombinator.com/item?id=47035788
tears-in-rain 9mo ago
opus 4.6 can use that from cli, and do RE, make pseudo C, and later decode binaries based on this code into interpretable data. amazing tool
iamleppert 9mo ago
Are these tools useable by OpenClaw yet?
givemeethekeys 9mo ago
How do they incentivize government employees into doing such excellent work without paying them a real tech salary?
- neodymiumphish 9mo ago
  Use military members. I was a special agent with an org involved in similar work. They put me through 7 SANS courses, including paying for 5 certs, in 18 months.
- bri3d 9mo ago
  They are contractors. The public face of Ghidra works at Praxis, for example.
- wat10000 9mo ago
  Great benefits and job security, and a belief in the mission.
  - wewtyflakes 9mo ago
    The job security perk was recently defenestrated.
    - wat10000 9mo ago
      Hopefully seen as an aberration. Otherwise we may see the excellent work go out the window along with it.
- commandersaki 9mo ago
  I wouldn't say a program in Java Swing / AWT would count as excellent.
- mandeepj 9mo ago
  $160k-$170k is not a bad salary; in some cases they get $250k, but sure, it's not a FAANG type.
alexfromapex 9mo ago
Strange to see the NSA using Java, maybe this is really old?
- zamadatix 9mo ago
  Some of the comment matches in the code search suggest at least portions of the codebase goes back to the very late 90s. Edit: Wikipedia has a table with 1.0 being 2003 https://en.wikipedia.org/wiki/Ghidra https://en.wikipedia.org/wiki/Ghidra
- bri3d 9mo ago
  Yes, it’s from the late 90s/early 00s, but why is it strange to see Java?
- belfthrow 9mo ago
  I suppose they should be using rust yeah?
dang 9mo ago
Here are the main threads (in reverse order) that I found about Ghidra generally. Of course there have been many more threads about specific aspects or related projects: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=Ghidra%20comments%3E0&sort=byDate&type=story&storyText=none https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... (Btw, these links are just for anyone curious to read more - reposts are fine after a year or so - https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html) NSA Ghidra open-source reverse engineering framework - https://news.ycombinator.com/item?id=40508777 https://news.ycombinator.com/item?id=40508777 - May 2024 (61 comments) Ghidra 11.0 Released - https://news.ycombinator.com/item?id=38740793 https://news.ycombinator.com/item?id=38740793 - Dec 2023 (11 comments) Ghidra 10.3 has been released - https://news.ycombinator.com/item?id=35908418 https://news.ycombinator.com/item?id=35908418 - May 2023 (6 comments) NSA Ghidra software reverse engineering framework - https://news.ycombinator.com/item?id=35324380 https://news.ycombinator.com/item?id=35324380 - March 2023 (103 comments) Ghidra: Software reverse engineering suite developed by NSA - https://news.ycombinator.com/item?id=33226050 https://news.ycombinator.com/item?id=33226050 - Oct 2022 (42 comments) Ghidra: A software reverse engineering suite of tools developed by the NSA - https://news.ycombinator.com/item?id=27818492 https://news.ycombinator.com/item?id=27818492 - July 2021 (142 comments) Ghidra 9.2 - https://news.ycombinator.com/item?id=25086519 https://news.ycombinator.com/item?id=25086519 - Nov 2020 (78 comments) The Ghidra Book - https://news.ycombinator.com/item?id=24879314 https://news.ycombinator.com/item?id=24879314 - Oct 2020 (5 comments) Ghidra Decompiler Analysis Engine - https://news.ycombinator.com/item?id=19599314 https://news.ycombinator.com/item?id=19599314 - April 2019 (30 comments) Ghidra source code officially released - https://news.ycombinator.com/item?id=19572994 https://news.ycombinator.com/item?id=19572994 - April 2019 (7 comments) Ghidra Capabilities – Get Your Free NSA Reverse Engineering Tool [pdf] - https://news.ycombinator.com/item?id=19319385 https://news.ycombinator.com/item?id=19319385 - March 2019 (17 comments) Ghidra, NSA's reverse-engineering tool - https://news.ycombinator.com/item?id=19315273 https://news.ycombinator.com/item?id=19315273 - March 2019 (405 comments) Ghidra - https://news.ycombinator.com/item?id=19239727 https://news.ycombinator.com/item?id=19239727 - Feb 2019 (59 comments) NSA to Release Their Reverse Engineering Framework GHIDRA to Public at RSA - https://news.ycombinator.com/item?id=18828083 https://news.ycombinator.com/item?id=18828083 - Jan 2019 (90 comments)
n00bs 9mo ago
Also worth mentioning this great MCP integration https://github.com/cyberkaida/reverse-engineering-assistant https://github.com/cyberkaida/reverse-engineering-assistant
boricj 9mo ago
Might as well plug in my own extension: https://github.com/boricj/ghidra-delinker-extension https://github.com/boricj/ghidra-delinker-extension It's a relocatable object file exporter that supports x86/MIPS and ELF/COFF. In other words, it can delink any program selection and you can reuse the bits for various use-cases, including making new programs Mad Max-style. It carved itself a niche in the Windows decompilation community, used alongside objdiff or decomp.me.
- WalterGR 9mo ago
  What is Mad Max-style?
  - barfiure 9mo ago
    I imagine PIE chunks that you can kludge into other programs to Frankenstein implementations? Kind of like how mad max cars are made of bits and pieces bolted together
    - boricj 9mo ago
      Indeed, you can kludge anything together into working chimeras, as long as you can mend the ABIs together. I've done a case study where I've ported a Linux a.out program into a native Windows PE program without source code: https://boricj.net/atari-jaguar-sdk/2023/11/27/introduction.html https://boricj.net/atari-jaguar-sdk/2023/11/27/introduction.... Another case study was ripping the archive code from a PlayStation game and stuffing it into a Linux MIPS program to create an asset extractor: https://boricj.net/tenchu1/2024/03/18/part-6.html https://boricj.net/tenchu1/2024/03/18/part-6.html
      - p0w3n3d 9mo ago
        You sir are a true wizard!
- montymintypie 9mo ago
  Easily one of the coolest RE projects out there, I've always looked on in awe. > The relocation table synthesizer analyzer relies on a fully populated Ghidra database (with correctly declared symbols, data types and references) in order to work It's a shame that this requirement exists (I am well aware that it's a functional necessity), because all the stuff I want to relink is far too big to make a full db!
dakolli 9mo ago
Everyone in the comments is like, "take a look at this AI tool for Ghirda" This is indicative of two things. 1. While I can't stand the guy, ya'll need to watch Peter Thiel's talk from 10-15 years ago at Stanford about not building the same thing everyone else is, a la, the obvious thing. 2. People are really attracted to using LLMs on deep thinking tasks, off shoring their thinking, to a "Think for me SaaS". This won't end well for you, there's no shortcuts in life that don't come with a (huge) cost. The person who showed their work and scored A's on math tests instead of just learning how to use a calculator, is better off in their career/endevours than the 80% of others who did the latter. If Laurie Wired makes an MCP for Ghirda and uses it that's one thing, you using it without ever reverse engineering extensively is completely different. I'd bet my bottom dollar that Laurie Wired doesn't prefer the MCP over her own mental processes 8/10 times.
- j45 9mo ago
  A VC might want variety and advise people he will vote with his dollars for variety, because he's not funding the same thing as everyone else is. Being first and the winner requires a lot to line up, so it shouldn't be the only, default, or best setting. Pursuing this is optimizing. Also a message from 10-15 years ago might not reflect the same context as today.
  - chairmansteve 9mo ago
    "A VC might want variety and advise people he will vote with his dollars for variety". In other words, what's good for Peter Theil might not be goid for you.
    - j45 9mo ago
      Yup. Therefore postulating it as a truth or standard is ok if that's what you agree with and want to also pursue, but it's important to keep in mind that valid goals are a spectrum.
- resonious 9mo ago
  This feels like a bit of a false dichotomy. Just because I give some thinking tasks to an AI doesn't mean I'm sitting there doing nothing while it thinks.
brcmthrowaway 9mo ago
I'm using a tool on Parallels on Mac that says "cannot run in virtual machine". Could I remove that check using Ghidra?
- saagarjha 9mo ago
  Yes, if you know what you’re looking for.
  - brcmthrowaway 8mo ago
    What am I looking for?
    - saagarjha 8mo ago
      Probably the string that it’s showing
alex7o 9mo ago
I want to say if somebody makes a tool like that it would be a big winner https://qira.me/ https://qira.me/
bradhe 9mo ago
I've actually been experimenting with using Ghidra and Opus to create human-consumable, reverse-engineered software. My ultimate dream would be a buildable EverQuest client. Opus does a decent job of pulling out various subsystems and understanding how it works. I was able to get a pretty much working networking layer for instance with less than an hour's work.
user3939382 9mo ago
I miss the analog of this community from the 90s. We had actual principles and ethos and wouldn’t have been caught dead upvoting and using software from the frickin NSA. Not that it’s any surprise here. Contemporary San Francisco driven software culture which is the majority represented on this forum have no qualms with FAANG ethics, open source is not really important either. Oh I’m sorry the NSA didn’t spy on the whole country “wittingly” according to our leaders, carry on and use their software no ethical conflict here.
- zmgsabst 9mo ago
  Having been in Seattle, I’m not sure there was a time the NSA wasn’t involved with technology — eg, UW hosted meetups between researchers, criminals, and the government at least that long. Who built the Echelon follow-up, proto-dragnet system that provided the framework for the spying you bemoan? — the one extended and taken live in the early 2000s? Those same 90s hackers you glorify.
  - user3939382 9mo ago
    > provided the framework for the spying you bemoan The community I’m talking about definitely weren’t like secretly building tools for these agencies. I mean this sincerely I have no idea what point you’re making. The agencies existed and made tech so by logical necessity people worked there. I didn’t say all people in computing. There was a prevalent community of programmers and hackers who understood what these organizations represented and would never be on a forum blithely talking about some tool they made as if it was acceptable. Shame on anyone using these tools and the lack of objection to this post is a metric of how disgusting computing culture and really this forum are.
    - zmgsabst 8mo ago
      > The community I’m talking about definitely weren’t like secretly building tools for these agencies. I mean this sincerely I have no idea what point you’re making. You knew exactly what point I’m making, because it’s the first thing you responded to. And indeed, what you responsed to throughout your question. So no, you’re not being sincere. Those groups always interacted and your bald assertion of their morality is directly contradicted by my experience of their interactions (eg, criminals and government corresponding at UW) and the change in Boomer and Gen X hackers following 9/11. > There was a prevalent community of programmers and hackers who understood what these organizations represented and would never be on a forum blithely talking about some tool they made as if it was acceptable. From their computers that originated in a US Navy lab? Again, my experience from Seattle is that the idealism was always more show than reality — and government technologies were not only consumed, but built on contract when interests aligned (eg, stopping cyber warfare or dismantling terrorist networks). What you’re describing — ineffective moral absolutism — wasn’t what I recall from the 90s hacker ethos that always existed in a liminal zone, but rather the 2010s era co-opting of existing groups (eg, Anyonymous) for moral crusading.
jeron 9mo ago
leave it to a three letter agency to use a pre-existing acronym for something pretty different
bawana 9mo ago
Do you think they use these tools in China or somethiing elsee?
ErroneousBosh 9mo ago
I guarantee that a million eyes have been all over this looking for the Super Sekrit Government Backdoors, too. If it was mine, I'd stick in a heavily-obfuscated bit of code for people to use Ghidra to reverse-engineer Ghidra to find out what it did. OMG, it's a keylogger! But it's not activated by default! How does it get activated? How does it emit its logs? And after weeks of poking they find you run it with "$ ACTIVATE_KEYLOGGER=true ghidra", and it saves to "$HOME/Desktop/ghidra_key_log.txt" Haha, psych!

433 points by handfuloflight 9mo ago

Cutter[1] by RizinOrg[2]. [1] https://github.com/rizinorg/cutter https://github.com/rizinorg/cutter [2] https://github.com/rizinorg/rizin https://github.com/rizinorg/rizin

aktau 9mo ago
+1 I once tried learning how to RE with radare2 but got very frustrated by frequent project file corruption (meaning radare2 could no longer open it). The way these project files work(ed?) in radare2 at the time was that it just saved all the commands you executed, instead of the state. This was brittle, in my experience. I don't have a lot of free time, so I have to leave projects for long periods of time, not being able to restart from a previous checkpoints meant I never actually got further. IIUC, one of the first things Rizin did was focus on saving the actual state, and backwards/forwards-compatibility. This fact alone made me switch to Rizin. To its credit, my 3-year old project file still works! Now for the downside: there is apparently a gap in Windows (32-bit) PE support, causing stack variables to be poorly discovered: https://github.com/rizinorg/rizin/issues/4608 https://github.com/rizinorg/rizin/issues/4608. I tested this on radare2, which does not have this bug. I'm hoping this gets fixed in Rizin at some point, at which point I'll continue my RE adventure. Or maybe I should give an AI reverse engineer a try... (https://news.ycombinator.com/item?id=46846101 https://news.ycombinator.com/item?id=46846101).
- xvilka 9mo ago
  Yes, we are working on rewriting analysis completely[1][2] that would fix your issue along with many others. [1] https://github.com/rizinorg/rizin/pull/5505 https://github.com/rizinorg/rizin/pull/5505 [2] https://github.com/rizinorg/rizin/issues/4736 https://github.com/rizinorg/rizin/issues/4736
  - aktau 9mo ago
    Can't wait! Do you have any idea how far along this is? Is it likely to be months, quarters, years? (Funny expression, that. I'll wait, of course. It'll be a happy day when this works again and I can slowly make progress RE'ing again.)
    - xvilka 9mo ago
      Months.
- alberto-m 9mo ago
  I tried radare2 with the official GUI Iaito. Iaito saves the project in a git repo, so whenever I got corruption (and I got it a lot, like every 4-5 saves) I was just a `git reset --hard` away from restoring a good state. Not the most efficient way of operation, but for me it was better this than tolerating Ghidra's tiny Courier New font.
  - aktau 9mo ago
    Thanks for the note. Your corruption frequency anecdote matches mine. I don't have the mental werewithal to deal with that. I won't go back to radare2 until they change their project file stability somehow.

mturk 9mo ago

Ghidra is a very impressive piece of software with a deep bench of functionality. The recent couple major releases that move to a more integrated Python experience have been very nice to use.

atemerev 9mo ago

I always wondered whether they have a much more capable internal version. And I wonder the same thing for AI labs (they have to do a lot of lobotomy for their models to be ready for public use... but internally, they can just skip this perhaps?)

jacquesm 9mo ago
Too many people in the know about this stuff I think to keep it hidden for that long. At the same time, we keep finding stuff that that should have held for and it didn't, so maybe you're right.
bjackman 9mo ago
Very likely people who actually work on RE at the NSA also have access to IDA Pro licenses. I don't work in this space, so take it with a pinch of salt, but my understanding is this is a fairly long term strategic initiative to _eventually_ be the best tool.
- 19h 9mo ago
  Ghidra has a slightly different focus than IDA, so they're definitely not just using Ghidra :-)
  - sergent_moon 9mo ago
    I have only a very basic understanding of the two tools. Can you give me just some highlights regarding their differences?
    - 19h 9mo ago
      Well, Ghidra's strength is batch processing at scale (which is why P-Code is less accurate than IDA's but still good enough) while allowing a massive amount of modules to execute. That allows huge distributed fleets of Ghidra. IDA has idalib now, and hcli will soon allow batch fleets, but IDA's focus is very much highly accurate analysis (for now), which makes it a lot less scalable performance wise (for now).

zeon256 9mo ago

Been awhile since I used this but decided to open the latest version to check my rust binary and was pleasantly surprised how much better it is today wrt rust binaries

flipped 9mo ago
Can you be more specific? Is it getting easier to reverse rust and go, since I have read about it being the hardest to reverse.
- quux0r 9mo ago
  It's not perfect, but in my personal experience it is still tough in languages like that due to the sheer volume of indirection and noise that makes it hard to follow. For example Go's calling convention is a little nutty compared to other languages, and you'll encounter a few *****ppppppppVar values that are otherworldly to make sense of, but the ability to recognize library functions and sys calls is for sure better.

systems 9mo ago

is ghidralite dot com a safe link or an official link when i try to expand their faq, it seem to try an open a (presumabl) malicious link , i wont paste the link here just in case it is really malicious

staubfinger 9mo ago
Just use the official github link or links that are linked there. The URL you mentioned seems bogus at best.
- waltbosz 9mo ago
  Curious, the ghidralite page download button links to the NSA's github releases page. I wonder what is the purpose of ghidralite dot com. SEO spam? Are they building trust and then will swap out the Download button with a poisoned binary.
  - h4ch1 9mo ago
    Or climb up high enough in the search results and sell the domain to a malicious actor.
dizzy9 9mo ago
Looks like AI slop and SEO junk. The Guide page you linked opens with an article on Dubai sports car rental. There are also .net and .org variants of the domain, which appear to be also AI-generated slop. There's no such program as Ghidralite, and every site just links to the official Ghidra repository.

jeevacation 9mo ago

[flagged]

13hunteo 9mo ago
You have a disgusting username
- flipped 9mo ago
  You're just giving the troll an audience by reacting to it.
- jeevacation 9mo ago
  [dead]

jeevacation 9mo ago

[flagged]

reactordev 9mo ago
No. Cheat engine scans memory as a program is running, for values of interest to pin (or modify). Allowing you to change behavior. Ghidra takes a program and unravels the machine code back into assembly and thus, something resembling C code. Allowing you to change behavior. Cheat Engine doesn’t modify the binary. Ghidra can.
- kaibee 9mo ago
  > Cheat Engine doesn’t modify the binary. Ghidra can. To clarify for other people who may not be familiar, (though I'm far from an expert on it myself) you can inject/modify asm of a running binary with CE. I'm not sure if there's a way to bake the changes to the exe permanently.

mdavid626 9mo ago

Works well. I used this tool once to disassemble and understand how key manager works on Vivotek cameras. They create executables, which contain encrypted binary data. Then, when the executable runs, it decodes the encrypted data and pipes it into "sh". The security is delusional here - the password is hard coded in the executable. It was something like "VIVOTEK Inc.". Ghidra was able to create the C code and I was able to extract also the binary data to a file (which is essentially the bash script).

mickeyp 9mo ago
Sounds like `strings' on the binary would've sufficed if it's just hardcoded.
- mdavid626 9mo ago
  No, that’s not enough. The password would be visible, but the encyption algorithm and the script’s text wouldn’t.

yibers 9mo ago

Can anyone provide their opinion of Ghidra vs Ida? Is Ida worth the extra money?

q3k 9mo ago
IDA is the better tool if you're being paid to work with architectures that IDA supports well (ARM(64), x86(_64), etc). This usually means 'mainstream' security/malware research. It's not worth the price for hobbyists. Before Hex-Rays was sold to private equity, it could make sense for rich hobbyists to pay for a private license once and use it for a few years without software updates, with the cloud offering now it pretty much makes no sense. Ghidra is the better tool if you're dealing with exotic architectures, even ones that you need to implement support for yourself. That's because any architecture that you have a full SLEIGH definition for will get decompilation output for free. It might not be the best decompiler out there, sure, but for some architectures it's the only decompiler available. Both are generally shit UX wise and take time to learn. I've mostly switched from IDA to Ghidra a while back which felt like pulling teeth. Now when I sometimes go back to IDA it feels like pulling teeth.
- 19h 9mo ago
  Which exotic architectures is IDA missing from your perspective?
  - q3k 9mo ago
    Stuff I've recently analyzed that IDA has no decomp support for (and Ghidra's is anywhere from good enough to actually good): - AVR - Z80 - HC08 - 8051 - Tricore - Xtensa - WebAssembly - Apple/Samsung S5L87xx NAND controller command sequencer VLIW (custom SLEIGH) And probably more that I've forgotten. It's also not about lack of support, but the fact that you have to pay extra for every single decompiler. This sucks if you're analyzing a wide variety of targets because of the kind of work you do. IDA also struggles with disasm for Harvard architectures which tend to make up a bulk of what I analyze - it's all faked around synthetic relocations. Ghidra has native support for multiple address spaces.

palata 9mo ago

Taking the opportunity to ask: are there nice recommended resources for a beginner to start with reverse engineering (ideally using Ghidra)? Let's say for an experienced developer, but not so experienced in reverse engineering? I guess one issue I have is that I don't have good ideas of fun projects, and that's probably something I need to actually get the motivation to learn. I can find a "hello world", that's easy, but it won't help me get an idea of what I could reverse engineer in my life. For instance I have a smartspeaker that I would like to hack (being able to run my own software on it, for fun), but I don't know if it is a good candidate for reverse engineering... I guess I would first need to find a security flaw in order to access the OS? Or flash my own OS (hoping that it's a Linux running there), but then I would probably want to extract binary blobs that work with the buttons and the actual speaker?

gray_charger 9mo ago
You can start here to learn reverse engineering. https://beginners.re/ https://beginners.re/
0x54MUR41 9mo ago
If you are into the book, I would recommend The Ghidra Book from No Starch publisher https://nostarch.com/ghidra-book-2e https://nostarch.com/ghidra-book-2e. The book is designed for beginner and advance users.
quux0r 9mo ago
So a couple things. Bruce Dang’s book, while a little old, is still a great spot to get started. Another great book is Blue Fox by Maria Markstedter for ARM. From there, finding small binaries and just trying to get the “flow” is a good next step, for me this is largely renaming functions and variables and essentially trying to work the decompiled code into something readable, then you can find flaws. So for the second thing, pulling the data off chips like that typically involves some specialized hardware, and you have to potentially deal with a bunch of cryptographic safeguards to read from the chip’s memory. Not impossible though, and there are not always good safeguards, but might be worth checking out some simpler programs and working up to it, or learning some basic hardware hacking to get an idea of how that process works.

quux0r 9mo ago

While on the topic, I want to highlight two incredible plugins for Ghidra: https://github.com/jtang613/GhidrAssist https://github.com/jtang613/GhidrAssist And https://github.com/jtang613/GhidrAssistMCP https://github.com/jtang613/GhidrAssistMCP Being able to hook Claude code up to this has made reversing way more productive. Highly recommend!

tomasphan 9mo ago
How willing is Claude to help you there?
- quux0r 9mo ago
  It's actually pretty good. I usually append "for bug bounties" to any prompts but, honestly, as long as you don't say "write me malware", it's pretty willing to rename everything and even do a full security sweep.
mixologic 9mo ago
A friend of mine has also been working on a Ghidra MCP: looks like theres a few of them: https://github.com/themixednuts/GhidraMCP https://github.com/themixednuts/GhidraMCP
nazgulsenpai 9mo ago
https://github.com/LaurieWired/GhidraMCP https://github.com/LaurieWired/GhidraMCP is great also
- GlumWoodpecker 9mo ago
  The author of this has an excellent tech YouTube channel: https://www.youtube.com/@lauriewired https://www.youtube.com/@lauriewired
  - hugh-avherald 8mo ago
    Bit advanced for Hacker News folks I think.

flipped 9mo ago

[flagged]

sabas123 9mo ago
Without providing any proof that either this or SELinux is backdoored.
LPisGood 9mo ago
Well it’s open source, so you can check in principle. I would imagine there’s some fame and notoriety in discovering that.
dizzy9 9mo ago
This was discussed when Ghidra was first open sourced. To the best of my knowledge, nobody's found an NSA backdoor in Ghidra.
jandrese 9mo ago
Seems like it would be of limited value to backdoor a program like Ghidra. Might be useful in identifying security researchers, except that it's also the kind of program that will often be running on disconnected systems with little valuable data beyond whatever is being disassembled.

alexrp 9mo ago

Binary Ninja deserves a mention in these threads: https://binary.ninja https://binary.ninja I've used IDA, Ghidra, and Binary Ninja a lot over the years. At this point I much prefer Binary Ninja for the task of building up an understanding of large binaries with many thousands of types and functions. It also doesn't hurt that its UI/UX feel like something out of this century, and it's very easy to automate using Python scripts.

xvilka 9mo ago
In particularly I like their approach of creating modern IR pipeline.
capl 9mo ago
Binary Ninja seems way ahead in terms of UX, as a hobby reverser. It's my default as well.
- zo1 9mo ago
  It's basically "VS Code" UX with dark mode. Come on, is this some sort of joke? Serious question.
  - EE84M3i 9mo ago
    Last time I used them - Ghidra, and to some extent IDA, had UXes that were very difficult for new users to pick up and frequently deviate from standard expectations for modern desktop apps because they have two decades of baggage. In contrast binary ninja is very easy to explore and has many fewer surprises.
  - psifertex 9mo ago
    I'm curious what you would consider better UX? We have actually been more inspired by Jetbrains lately than VS Code. Take that for what you will. We do try to pick simple sane defaults while still allowing enough customization to adapt to different workflows. Actually working on a startup wizard for first time users if they want to more closely replicate the feel of other RE tools since muscle memory is hard to break.

jakozaur 9mo ago

Funny thing, AI is not that terrible at using Ghidra. We released a benchmark on that and hopefully models will improve: https://quesma.com/blog/introducing-binaryaudit/ https://quesma.com/blog/introducing-binaryaudit/

Alifatisk 9mo ago
There is MCPs for Ghidra
- joe_mamba 9mo ago
  Yeah this. I saw some guys on youtube use AI MCPs to do some crazy reverse engineering. It's difficult to be an AI doomer when you see stuff like this.
  - thenaturalist 9mo ago
    Would you have a link / links or hints about the channel?
  - le-mark 9mo ago
    “AI Doomer” is ambiguous here! Do you mean someone who optimistic about ai will never amount to anything, or that ai won’t be the end of humanity?

Supermancho 9mo ago

I first used Ghidra this weekend as part of this series: https://www.youtube.com/watch?v=d7qVlf81fKA&list=PL4X0K6ZbXhIMcLiddydGAPKynJRVjtyv- https://www.youtube.com/watch?v=d7qVlf81fKA&list=PL4X0K6ZbXh... (#3 forward uses Ghidra) It worked fine in Ubuntu and Windows. The interface takes some getting used to, but paired with Bless Unofficial (using snap to install), it makes reverse engineering smooth.

commandersaki 9mo ago

Awful to use with a tiling window manager.

stared 9mo ago

Awesome soft! It works surprisingly nicely with AI agents (I mean, like Cursor or Claude Code, I don't let it run autonomously!). Here on detecting malware in binaries (https://quesma.com/blog/introducing-binaryaudit/ https://quesma.com/blog/introducing-binaryaudit/). I am now in process of recompiling and old game Chromatron, from PowerPC binary to Apple Silicon and WASM (https://p.migdal.pl/chromatron-recompiled/ https://p.migdal.pl/chromatron-recompiled/, ready to play, might be still rough edges).

Alifatisk 9mo ago

There is also Hopper for ObjC/Swift, haven't tried it personally though https://www.hopperapp.com https://www.hopperapp.com

saagarjha 9mo ago
Hopper is pretty but worse than Ghidra for both

29athrowaway 9mo ago

OllyDbg inspired: https://github.com/eteran/edb-debugger https://github.com/eteran/edb-debugger

jevinskie 9mo ago

Is it just me or is the merge style used for the repo very difficult to follow? Am I holding it wrong?

mahaloz 9mo ago

Since we’re talking about decompilers, might as well mention the community around the research area: http://decompilation.wiki/ http://decompilation.wiki/ As well as the research history (slated to be updated in a few days): https://mahaloz.re/dec-progress-2024 https://mahaloz.re/dec-progress-2024

Melonai 9mo ago
Agh I really wish these awesome community wikis would be easier to find when you don't know about them, they usually have such a cool trove of information. The one I love quite I love is the OSDev Forums Wiki, though that one is well known and loved by a lot of people in the space. We really need to protect these projects somehow, more and more stuff and expertise is getting hidden in Discord servers, completely unsearchable and locked away within the minds of the members...

maximalthinker 9mo ago

[dead]

ambitious_whale 9mo ago

What does it do I don't understand a think can someone explain me

lacoolj 9mo ago

Posting this on Github is a brilliant move by the NSA, and it showing up on HN amplifies it even more. It's certainly not the first thing they've released (selinux, for one, and then all the other repos in the account), but this repo showing up on HN, with a prominent call-to-action to look at a career with them, is a great way to target the applicants you want ("those who would find this project interesting, because it's just the sort of thing we need them to work on") Atlassian used to do (maybe still does) this in bitbucket if you open dev tools - a link to their careers page shows up

deleted 9mo ago

[deleted]

kugutsumen 9mo ago

unflutter supports ghidra :) https://news.ycombinator.com/item?id=47035788 https://news.ycombinator.com/item?id=47035788

tears-in-rain 9mo ago

opus 4.6 can use that from cli, and do RE, make pseudo C, and later decode binaries based on this code into interpretable data. amazing tool

iamleppert 9mo ago

Are these tools useable by OpenClaw yet?

givemeethekeys 9mo ago

How do they incentivize government employees into doing such excellent work without paying them a real tech salary?

neodymiumphish 9mo ago
Use military members. I was a special agent with an org involved in similar work. They put me through 7 SANS courses, including paying for 5 certs, in 18 months.
bri3d 9mo ago
They are contractors. The public face of Ghidra works at Praxis, for example.
wat10000 9mo ago
Great benefits and job security, and a belief in the mission.
- wewtyflakes 9mo ago
  The job security perk was recently defenestrated.
  - wat10000 9mo ago
    Hopefully seen as an aberration. Otherwise we may see the excellent work go out the window along with it.
commandersaki 9mo ago
I wouldn't say a program in Java Swing / AWT would count as excellent.
mandeepj 9mo ago
$160k-$170k is not a bad salary; in some cases they get $250k, but sure, it's not a FAANG type.

alexfromapex 9mo ago

Strange to see the NSA using Java, maybe this is really old?

zamadatix 9mo ago
Some of the comment matches in the code search suggest at least portions of the codebase goes back to the very late 90s. Edit: Wikipedia has a table with 1.0 being 2003 https://en.wikipedia.org/wiki/Ghidra https://en.wikipedia.org/wiki/Ghidra
bri3d 9mo ago
Yes, it’s from the late 90s/early 00s, but why is it strange to see Java?
belfthrow 9mo ago
I suppose they should be using rust yeah?

dang 9mo ago

Here are the main threads (in reverse order) that I found about Ghidra generally. Of course there have been many more threads about specific aspects or related projects: https://hn.algolia.com/?dateRange=all&page=0&prefix=true&query=Ghidra%20comments%3E0&sort=byDate&type=story&storyText=none https://hn.algolia.com/?dateRange=all&page=0&prefix=true&que.... (Btw, these links are just for anyone curious to read more - reposts are fine after a year or so - https://news.ycombinator.com/newsfaq.html https://news.ycombinator.com/newsfaq.html) NSA Ghidra open-source reverse engineering framework - https://news.ycombinator.com/item?id=40508777 https://news.ycombinator.com/item?id=40508777 - May 2024 (61 comments) Ghidra 11.0 Released - https://news.ycombinator.com/item?id=38740793 https://news.ycombinator.com/item?id=38740793 - Dec 2023 (11 comments) Ghidra 10.3 has been released - https://news.ycombinator.com/item?id=35908418 https://news.ycombinator.com/item?id=35908418 - May 2023 (6 comments) NSA Ghidra software reverse engineering framework - https://news.ycombinator.com/item?id=35324380 https://news.ycombinator.com/item?id=35324380 - March 2023 (103 comments) Ghidra: Software reverse engineering suite developed by NSA - https://news.ycombinator.com/item?id=33226050 https://news.ycombinator.com/item?id=33226050 - Oct 2022 (42 comments) Ghidra: A software reverse engineering suite of tools developed by the NSA - https://news.ycombinator.com/item?id=27818492 https://news.ycombinator.com/item?id=27818492 - July 2021 (142 comments) Ghidra 9.2 - https://news.ycombinator.com/item?id=25086519 https://news.ycombinator.com/item?id=25086519 - Nov 2020 (78 comments) The Ghidra Book - https://news.ycombinator.com/item?id=24879314 https://news.ycombinator.com/item?id=24879314 - Oct 2020 (5 comments) Ghidra Decompiler Analysis Engine - https://news.ycombinator.com/item?id=19599314 https://news.ycombinator.com/item?id=19599314 - April 2019 (30 comments) Ghidra source code officially released - https://news.ycombinator.com/item?id=19572994 https://news.ycombinator.com/item?id=19572994 - April 2019 (7 comments) Ghidra Capabilities – Get Your Free NSA Reverse Engineering Tool [pdf] - https://news.ycombinator.com/item?id=19319385 https://news.ycombinator.com/item?id=19319385 - March 2019 (17 comments) Ghidra, NSA's reverse-engineering tool - https://news.ycombinator.com/item?id=19315273 https://news.ycombinator.com/item?id=19315273 - March 2019 (405 comments) Ghidra - https://news.ycombinator.com/item?id=19239727 https://news.ycombinator.com/item?id=19239727 - Feb 2019 (59 comments) NSA to Release Their Reverse Engineering Framework GHIDRA to Public at RSA - https://news.ycombinator.com/item?id=18828083 https://news.ycombinator.com/item?id=18828083 - Jan 2019 (90 comments)

n00bs 9mo ago

Also worth mentioning this great MCP integration https://github.com/cyberkaida/reverse-engineering-assistant https://github.com/cyberkaida/reverse-engineering-assistant

boricj 9mo ago

Might as well plug in my own extension: https://github.com/boricj/ghidra-delinker-extension https://github.com/boricj/ghidra-delinker-extension It's a relocatable object file exporter that supports x86/MIPS and ELF/COFF. In other words, it can delink any program selection and you can reuse the bits for various use-cases, including making new programs Mad Max-style. It carved itself a niche in the Windows decompilation community, used alongside objdiff or decomp.me.

WalterGR 9mo ago
What is Mad Max-style?
- barfiure 9mo ago
  I imagine PIE chunks that you can kludge into other programs to Frankenstein implementations? Kind of like how mad max cars are made of bits and pieces bolted together
  - boricj 9mo ago
    Indeed, you can kludge anything together into working chimeras, as long as you can mend the ABIs together. I've done a case study where I've ported a Linux a.out program into a native Windows PE program without source code: https://boricj.net/atari-jaguar-sdk/2023/11/27/introduction.html https://boricj.net/atari-jaguar-sdk/2023/11/27/introduction.... Another case study was ripping the archive code from a PlayStation game and stuffing it into a Linux MIPS program to create an asset extractor: https://boricj.net/tenchu1/2024/03/18/part-6.html https://boricj.net/tenchu1/2024/03/18/part-6.html
    - p0w3n3d 9mo ago
      You sir are a true wizard!
montymintypie 9mo ago
Easily one of the coolest RE projects out there, I've always looked on in awe. > The relocation table synthesizer analyzer relies on a fully populated Ghidra database (with correctly declared symbols, data types and references) in order to work It's a shame that this requirement exists (I am well aware that it's a functional necessity), because all the stuff I want to relink is far too big to make a full db!

dakolli 9mo ago

Everyone in the comments is like, "take a look at this AI tool for Ghirda" This is indicative of two things. 1. While I can't stand the guy, ya'll need to watch Peter Thiel's talk from 10-15 years ago at Stanford about not building the same thing everyone else is, a la, the obvious thing. 2. People are really attracted to using LLMs on deep thinking tasks, off shoring their thinking, to a "Think for me SaaS". This won't end well for you, there's no shortcuts in life that don't come with a (huge) cost. The person who showed their work and scored A's on math tests instead of just learning how to use a calculator, is better off in their career/endevours than the 80% of others who did the latter. If Laurie Wired makes an MCP for Ghirda and uses it that's one thing, you using it without ever reverse engineering extensively is completely different. I'd bet my bottom dollar that Laurie Wired doesn't prefer the MCP over her own mental processes 8/10 times.

j45 9mo ago
A VC might want variety and advise people he will vote with his dollars for variety, because he's not funding the same thing as everyone else is. Being first and the winner requires a lot to line up, so it shouldn't be the only, default, or best setting. Pursuing this is optimizing. Also a message from 10-15 years ago might not reflect the same context as today.
- chairmansteve 9mo ago
  "A VC might want variety and advise people he will vote with his dollars for variety". In other words, what's good for Peter Theil might not be goid for you.
  - j45 9mo ago
    Yup. Therefore postulating it as a truth or standard is ok if that's what you agree with and want to also pursue, but it's important to keep in mind that valid goals are a spectrum.
resonious 9mo ago
This feels like a bit of a false dichotomy. Just because I give some thinking tasks to an AI doesn't mean I'm sitting there doing nothing while it thinks.

brcmthrowaway 9mo ago

I'm using a tool on Parallels on Mac that says "cannot run in virtual machine". Could I remove that check using Ghidra?

saagarjha 9mo ago
Yes, if you know what you’re looking for.
- brcmthrowaway 8mo ago
  What am I looking for?
  - saagarjha 8mo ago
    Probably the string that it’s showing

alex7o 9mo ago

I want to say if somebody makes a tool like that it would be a big winner https://qira.me/ https://qira.me/

bradhe 9mo ago

I've actually been experimenting with using Ghidra and Opus to create human-consumable, reverse-engineered software. My ultimate dream would be a buildable EverQuest client. Opus does a decent job of pulling out various subsystems and understanding how it works. I was able to get a pretty much working networking layer for instance with less than an hour's work.

user3939382 9mo ago

I miss the analog of this community from the 90s. We had actual principles and ethos and wouldn’t have been caught dead upvoting and using software from the frickin NSA. Not that it’s any surprise here. Contemporary San Francisco driven software culture which is the majority represented on this forum have no qualms with FAANG ethics, open source is not really important either. Oh I’m sorry the NSA didn’t spy on the whole country “wittingly” according to our leaders, carry on and use their software no ethical conflict here.

zmgsabst 9mo ago
Having been in Seattle, I’m not sure there was a time the NSA wasn’t involved with technology — eg, UW hosted meetups between researchers, criminals, and the government at least that long. Who built the Echelon follow-up, proto-dragnet system that provided the framework for the spying you bemoan? — the one extended and taken live in the early 2000s? Those same 90s hackers you glorify.
- user3939382 9mo ago
  > provided the framework for the spying you bemoan The community I’m talking about definitely weren’t like secretly building tools for these agencies. I mean this sincerely I have no idea what point you’re making. The agencies existed and made tech so by logical necessity people worked there. I didn’t say all people in computing. There was a prevalent community of programmers and hackers who understood what these organizations represented and would never be on a forum blithely talking about some tool they made as if it was acceptable. Shame on anyone using these tools and the lack of objection to this post is a metric of how disgusting computing culture and really this forum are.
  - zmgsabst 8mo ago
    > The community I’m talking about definitely weren’t like secretly building tools for these agencies. I mean this sincerely I have no idea what point you’re making. You knew exactly what point I’m making, because it’s the first thing you responded to. And indeed, what you responsed to throughout your question. So no, you’re not being sincere. Those groups always interacted and your bald assertion of their morality is directly contradicted by my experience of their interactions (eg, criminals and government corresponding at UW) and the change in Boomer and Gen X hackers following 9/11. > There was a prevalent community of programmers and hackers who understood what these organizations represented and would never be on a forum blithely talking about some tool they made as if it was acceptable. From their computers that originated in a US Navy lab? Again, my experience from Seattle is that the idealism was always more show than reality — and government technologies were not only consumed, but built on contract when interests aligned (eg, stopping cyber warfare or dismantling terrorist networks). What you’re describing — ineffective moral absolutism — wasn’t what I recall from the 90s hacker ethos that always existed in a liminal zone, but rather the 2010s era co-opting of existing groups (eg, Anyonymous) for moral crusading.

jeron 9mo ago

leave it to a three letter agency to use a pre-existing acronym for something pretty different

bawana 9mo ago

Do you think they use these tools in China or somethiing elsee?

ErroneousBosh 9mo ago

I guarantee that a million eyes have been all over this looking for the Super Sekrit Government Backdoors, too. If it was mine, I'd stick in a heavily-obfuscated bit of code for people to use Ghidra to reverse-engineer Ghidra to find out what it did. OMG, it's a keylogger! But it's not activated by default! How does it get activated? How does it emit its logs? And after weeks of poking they find you run it with "$ ACTIVATE_KEYLOGGER=true ghidra", and it saves to "$HOME/Desktop/ghidra_key_log.txt" Haha, psych!