Debugger Ghidra Class | Hacker News Reader

Debugger Ghidra Class

github.com

199 pointssimonpure27 comments

Ghidra is a lifesaver for legacy systems that have a bunch of home-spun executables that make bespoke things function and rotate out random technicians over the years, when they fail it is a pain to figure out what they explicitly do, so reverse engineering them is sometimes the only option when a new tool needs to be built that does the same thing but without the parts that are deprecated. I hadn't seen this class before so I look forward to filling in my knowledge gaps around this software, thank you.

I patched a bug in a router firmware and jailbroke another router using Ghidra (mostly but also binwalk).

I have no business being able to do either, still both became weekend tasks using Ghidra.

I've since played around with hopper, binary ninja and radare2. Fun!

> I've since played around with hopper, binary ninja and radare2. Fun!

Would you recommend any of those. I’ve only ever played with the limited free IDA and Ghidra.

Only Radare2 which is FOSS and also can use the Ghidra decompiler.

It's also cool as hell to use if you use the command line UI (nurses?)

You might want to check Cutter[1][2] also. Our release builds come with decompiler included.

[1] https://cutter.re

[2] https://github.com/rizinorg/cutter

Sorry I missed you out! I have used cutter.

It may be a sore point but I have a niggling curiousity did cutter previously work with R2 and there was some beef?

See "Why did you fork radare2?" [1] from the Rizin FAQ.

For more details, see (well, listen to) the episode of the Unnamed Reverse Engineering podcast which covered Rizin/Cutter [2].

[1] https://rizin.re/posts/faq/

[2] https://unnamedre.com/episode/45

See also my answer in a different thread about technical differences between two: https://news.ycombinator.com/item?id=36399085

there's a name I haven't seen in a minute, I'll have to check this out again

I'd recommend binary ninja if you're serious about reversing. Not that expensive for a personal license.

Ghidra is nice, but being FOSS it will always be slightly worse then paid. It's fantastic for free, but not perfect. If reversing is part time/once a month/once every few months then its probably the best choice. Used it for a few years professionally.

binja is my favorite and been using it for the last year or so. just an absolute pleasure to use and collaborate with. IMO the best of all these tools. vector35 are great to work with as well. plugin development is real nice too

IDA pro is the worst. hexrays are plain awful to work with and its so overpriced.

hopper haven't tried, but seems good. mac only though

r2 is interesting. great if you only have a headless connection, but difficult. Learning curve is tough, and payoff isn't necessarily there. an alternative to ghidra if you want free but want to feel more l33t

> Ghidra is nice, but being FOSS it will always be slightly worse then paid.

lol, you know this isn’t true :)

This is a strange take for me to see, maybe OP doesn't have the context that the US government has been funding Ghidra development for years now (before ultimately open sourcing it), and will no doubt continue to do so for years to come.

This is the software used by NSA and contractors to analyze malware. From a UI perspective I get that it's clunky, but from a capabilities perspective I doubt there is much lacking.

> I have no business being able to do either ...

Why not?

They probably mean Ghidra made it relatively easy despite them not having that much experience in it

Oh it's "class" as in "lesson", not OOP. Since it's a link to GitHub, somehow I expected the latter (a plugin in some NSA tool?), but this is much more interesting.

I have a good experience with Cutter (Rizin's official GUI).

Anyone can comment on the functionality difference between the two? Any advantages to using Ghidra directly?

I must confess that when starting out I opted for Cutter just because of Ghidra's JVM dependency. But this is only due to old scars and my aversion to installing Java is probably outdated now. (I am not the only one though: Cutter can also use Ghidra's decompiler component, and its website proudly adds "no Java involved".)

Yeah there must be a reason why „nobody“ is using Cutter, interested in that as well.

Probably because noone wants to user rizin when you can use radare2. :-)

What about x64dbg? Is that considered the standard on Windows?

I'm still fuzzy on the difference between the two, would you mind to elaborate?

There are many different technical differences that accumulated over time - we save projects as a state snapshot, not a sequence of commands[1], we save types as semantically connected structures in a database that is guaranteed to be consistent[2], use better stack tracking for arguments and variables[3], not SP/BP/whatever, slowly migrate to a new generation of IL - RzIL instead of ESIL[4], provide standard libraries signatures out of the box in the FLIRT format[5], switched to a new way of parsing and processing commands[6], provide basefind, and many other small differences.

[1] https://rizin.re/posts/introducing-projects/

[2] https://github.com/rizinorg/rizin/tree/dev/librz/type

[3] https://github.com/rizinorg/rizin/releases/tag/v0.5.0

[4] https://github.com/rizinorg/rizin/blob/dev/doc/rzil.md

[5] https://github.com/rizinorg/sigdb

[6] https://rizin.re/posts/rzshell/

Other options are typically more fully-baked and conventional.

What are Rizin and Cutter, and what value do they offer over Ghidra?

This looks very interesting!

Question: looks like Ghidra can be used as a GDB "interface", is that correct?

Yes. Actually, the OP is all about driving gdb from Ghidra. It is only one part of the larger "Ghidra Class" (see repo's parent folder). The parts are:

- Beginner

- Intermediate

- Advanced

- AdvancedDevelopment

- Debugger (the OP)

- ExerciseFiles

From the title I was first expecting some kind of educational material, but then I saw the link and knowing that Ghidra itself is for the most part written in Java I thought then that it would be about Java internals used by the debugger portion of Ghidra. Happy to learn that it is indeed educational material as I have only scratched the surface of Ghidra myself and have a lot to learn about it.

I hope they continue to produce new training material, perhaps using some kind of GhidraClassFactory.

Reply on news.ycombinator.com