NSA Ghidra open-source reverse engineering framework | Hacker News Reader

NSA Ghidra open-source reverse engineering framework

ghidra-sre.org

127 pointsmodinfo61 comments

I wonder how Hex-Rays IDA sales are doing since Ghidra was released. Edit: If anyone can read French accounts: https://consult.cbso.nbb.be/consult-enterprise/0873473914

Biggest impact was reduction of the typical "find untrojaned chinese bootleg copy of IDA" step.

Not that it disappeared completely, but there's less of a need :)

Cracking IDA is a right of passage

Most Ghidra discussion I see online boils down to whining that it's not IDA Pro, so, probably not bad.

From my experience, the muscle memory is strong with ida. Once you’re used to it, it’s hard to switch. So I don’t expect that there was a dramatic plunge as soon as ghidra was released.

I have no inside knowledge but I expect the sales drop slowly as new users start with ghidra instead of ida.

I guess IDA is the Photoshop of software RE.

Spatial memory … the good reason no one likes interface changes.

What's annoying in IDA Pro price system is that for every OS you need a separate license. Every other tool - Binary Ninja, JEB, etc - has just a license for particular edition and add-ons but it is valid for every operating system.

Piracy-wise it's a good strategy though.

Most of leaked copies in recent years were specifically bought to be pirated (except Keen Lab one, rip), and as Windows binaries are the actually portable executables now because of ABI stability and Wine, they almost always buy the Windows version.

I've never seen a single leaked Linux IDA Pro and it's immensely useful to have IDA on a real OS without headaches caused by Wine.

I don't think anything changed commercially. In security companies, know hows, scripts, support, feature set, is all IDA, not Ghidra. Especially the feature set is not yet the same (IDA has more bells and whistles).

Personally, I've switched to Ghidra for most of the things, IDA only when Ghidra doesn't handle something. But then again, personally I never was an IDA customer, beacuse it's too expensive for hobbyist use (and IDA Free is too limited).

I think the effect on pirated debuggers might have been bigger. When I was young and dabbled in this space one fun part of the experience was finding a cracked version of Olly that didn't have custom trojans in it. I'm sure this tradition continued after I sort of dropped out, at least until Ghidra and WinDbg and low-threshold gdb-facades made it less relevant.

Cracked versions of OllyDbg? Wasn't OllyDbg always free?

Nah, it was shareware at first.

V1 is still shareware, but wasn't it always free to use? I mean, not that it matters in the long run, now I guess Olly was superseded by x64dbg anyway, but as a person who migrated from SoftICE to Olly, I've never had to find a cracked version for it. But the again, I was one of those "last men standing" when it came to migration, so I could migrate relatively late compared to others.

I'm developing my own Ghidra extension that can export object files out of a program selection: https://github.com/boricj/ghidra-delinker-extension

Ghidra's data model, analyzers and UI gave me a framework that allowed me to experiment and focus on the specifics of delinking, which is the key to make this idea work. Without that, I would not have been able to pull it off and I would've given up on my decompilation project a long time ago, for lack of a means to divide and conquer it.

Joe Grand's latest video shows a clever usage of Ghidra to understand insecure password generator methods and recover lost BTC. https://youtu.be/o5IySpAkThg?si=EGhF7Jf01G6nQPL9

Maybe I missed it but it seems like he used it like anyone familiar with reverse engineering would? The video just shows the use of the decompiler, briefly, right?

Perhaps, I've just never seen Ghidra used like this. For me, the clever part was putting together that the password generator method used time. Then putting together a wrapper app to batch produce passwords from the timeframe the client would have generated the passwords.

Can we put a date on this? I was in undergrad when this was released.

Can we put a date on this, I have no idea when you were an undergrad. ;)

NSA Ghidra open-source reverse engineering framework (c. 2017-2020)

This was released March 2019 as part of the RSA conference[0]

[0] https://www.rsaconference.com/Library/presentation/USA/2019/...

Purely out of ignorance - what's the context here? I'm not in this space, but afaik Ghidra was released years ago so I'm guessing this post was triggered by a recent development, but it's not clear what that might be.

As someone who is in this space, I’m not aware of any recent major developments so it’s most likely someone just thought it’s cool and hasn’t been talked about on HN in sufficiently long

Yesterday Joe Grand put up a video explaining how he used Ghidra to find the password generator pattern and helped someone recover 43 BTC. For some folks, that was probably their first time seeing Ghidra in action and I imagine it sparked the curiosity flame again.

People post random stuff on here all the time. Often it is just a Wikipedia link to some topic with no context, no discussion or anything. I think it is lazy karma whoring and it works because people upvote it if they know what it is an like it. I might go ahead and submit the Wiki page for Rust :)

Those post often tie into current events or are timely for other reasons. The ones that get voted to top at least.

I'm confused too. I haven't seen anything in that link that might be new and justifies this random post.

People can post things because it’s new to them!

Nothing new, just one of today’s lucky “Ten Thousand” → https://xkcd.com/1053/

Ghidra is powerful. The only thing I miss is the ability to actually do versioned (=Git) collaboration, or at least to publish stuff to Github or whatever without needing to either host Ghidra Server myself or depend on someone else.

Rizin[1]/Cutter[2] projects are stored like text files that work well with git, you could try those tools.

[1] https://rizin.re

[2] https://cutter.re

Rizin is a fork of radare2, so I guess mentioning the original would also be a nice thing to do:

https://rada.re

True, though there's a huge difference how projects are stored in both: https://rizin.re/posts/introducing-projects/

I mean of course there are differencies, if they would be the same then there would be no point in the fork, right? :)

Well, unless it was due to ideological reasons, I remember Rubocop (linter for Ruby) had some ideological forks at some point in time.

Heh, that looks interesting. Thanks!

Ghidra is an amazing tool, and indeed the fact that the NSA contributed this to the public is amazing, but understandable if your goal is to enhance cyber-security: it is the perfect swiss knife to figure out if there's nasty things embedded in binary blobs.

The one thing I would love to see come to Ghidra is an ML powered assistant that adds two features:

    - AI-powered automated, semantically relevant, routine and variable naming

    - AI-powered compiler recognition and improved recovery of loop structure

Both things should be possible using LLMs and the fact that compilers can be used to generate an infinite size training set for almost free.

There are plugins which do this already. Bring your own openai license.

hope you're not doing something that ChatGPT would be able to catalog and resell...

Nothing but praise for Ghidra. It’s very powerful and intuitive to use. I’m still stunned that the NSA contributed to the public for once

You might be familiar with NSA as an offensive agency interested in subverting security systems, but it's actually composed of two separate and often warring divisions, the second of which is defensive in nature and is interested in securing systems. It is this second division which has a history of contributing in good faith to security projects, public and otherwise.

Which one is responsible for their bad faith, public, defensive contributions?

https://en.wikipedia.org/wiki/Dual_EC_DRBG

That seems offensive.

I thought the offensive part of the NSA was the part that was capturing encrypted Internet traffic to later decrypt.

offensive, in the sense that breaking key cryptograph would allow them into (foreign) systems.

defensive in the sense that the block access into (American gov & private sector) systems via things like SELinux

>I’m still stunned that the NSA contributed to the public for once

They contributed SELinux too and sponsored the TrustedBSD Project.

As good as SELinux and TrustedBSD are, I wouldn't expect them to be any sort of defense against the NSA. I wouldn't expect them to publish anything that they can't already own when they want to.

The only thing that can protect you from state actors is a one-way data diode, and/or a complete air gap system with rigorous physical security AKA another state...and even then...spies ;)

The NSA has contributed many things such as SELinux and more.

They also contributed Apache NiFi but that was much earlier: https://nifi.apache.org/

what you don't want all their crypto libraries? As targeted as go, this is right up there.

I just can't stand Ghidra's UI. Trying to get it to look nice, at least on Linux with HiDPI, is such a chore. These Eclipse-y GUIs have aged like milk

Ghidra uses Swing, which is almost the exact opposite of what Eclipse uses (SWT). Swing can be made to look very nice as shown by these demos:

https://www.jgoodies.com/downloads/demos/

Ghidra could use a Swing refresh, but its UI/UX has more to do with the lack of a UI/UX designer than Swing itself.

Additionally, all of IntelliJ products use Swing and I consider their UI's to be beautiful. So, it's not the UI toolkit, but rather the implementation.

Heh, they offer a Java WebStart link - for the 10 people still running Netscape on WinXP I guess :-D

Cheekiness aside, I did find their .jnlp handy for getting the right invocation args

  java --add-exports=java.desktop/com.sun.java.swing.plaf.windows=ALL-UNNAMED -Djnlp.packEnabled=true -jar smart-client-showcase-24.04.0.jar

You can tweak the arguments given to the JVM by editing the support/launch.properties file. In particular, you can change the UI scale with the sun.java2d.uiScale property, which is set by default to 1.

> Linux with HiDPI, is such a chore

There's a simple broad-spectrum fix for that. For the odd occasion I want to view high definition photos in Linux I just switch screen mode temporarily, for the rest it is sooo not worth the hassle

What's the history of the name?

Ghidra sounds Russian (Гидра) for Hydra.

Was it considered cool to use Russian words for hacker/spy things?

> Please remember that the NSA is run by a bunch of nerds and Ghidorah in Japanese cinema is a movie about a three headed monster. In the film, an extraterrestrial from Venus, possessing the body of a princess, warns humanity of the pending destruction by the alien-dragon King Ghidorah-with Godzilla, Rodan, and Mothra being their last hope for survival.

Ghidra is a monster from the Godzilla movies. I don't know if it's some Japanese version of "Hydra".

> The "Ghidorah" part of King Ghidorah's name comes from the pronunciation of the word "hydra" (Гидра, ˈɡʲidrɐ) in Russian, written as ヒドラ (Hidora) in Japanese.

Good eye, looks like the name does originate from that.

Just looking at what AI can do with a simple error message should tell you heaps and bounds how much help it could be in analysis for reverse engineering.

Reply on news.ycombinator.com