psifertex

Those are not the only choices:

Binary Ninja (disclaimer: BN dev here) Hopper JEB Relyze

That said, I 100% agree with the impact Ghidra has had on the market. It's definitely making it _much_ harder to sell a commercial product when a well maintained, zero cost, open source alternative is available. If we (Vector 35, Binary Ninja devs) hadn't been as far along in our development roadmap and growing our customer base as we were when Ghidra was released we'd likely have had to simply do something else which would be an overall loss for the community.

Who knows what other products/ideas will now never see the light of day. The barrier to entry was already extremely high in this space for a limited return, but now? Nearly impossible for anyone new to entry.

If automation and analysis over the IR is your goal, Binary Ninja is the far better choice compared to both Ghidra and IDA. There's always things to work on but even most people who don't use Binary Ninja regularly who have evaluated it agree that our API/BNIL stack is superior to other options.

Disclaimer: BN founder, so biased of course but I'm pretty up-front about our strengths/weaknesses.

A survey of reverse engineers which answers the questions of how humble they are (among other things).

It's absurd to think that OS updates should in perpetuity guarantee compatibility with all prior versions.

I don't think that's the issue (or at least not the only one). I see the same thing and even though I just switched my MacOS/General Appearance setting to Light instead of Auto I still see all black in Firefox.

Otherwise known as a "megaminx" it's solvable using almost the exact same techniques (with small variation) to a regular 3x3 depending on the method used.

Likely the Japanese color scheme: https://ruwix.com/the-rubiks-cube/japanese-western-color-sch...

Won three times, definitely didn't hurt my career.

Yeah, sorry for being slow on the uptake there. The negative threw me off. :-P

Oh also, just to clarify -- are you talking about Binary Ninja or something else? That would explain a lot of my confusion. :-P

This is really strange to hear. What self service site did you use? Our website chat goes right to a slack channel that multiple folks monitor and reply to at all hours of the day. Worst case if we're all sleeping and you leave an email we respond when we're awake.

Just searched for your username in our chat and our email and don't see anything so I assume you've got a different email?

I'm sorry you had a bad experience. This is the first I've heard about it! We normally get nothing but praise during any customer support interaction. Feel free to email me directly (jordan at vector35 com) with your email address so I can try to figure out what happened. Apologies it didn't go well.

Not right now -- we might change that in the future though.

PowerPC is close to being done (also, the armv8 support is quite solid but the v7 needs work and thumb isn't integrated but is mostly complete).

A few of our early users are also working on some other architecture plugins so I think MSP430 or AVR might exist soon.

Yup! QT. Electron might be fast enough for graph view, I don't know, we'd have to test it. The good news is that the core is completely separable from the interface so we could re-architect the GUI if needed.

There's plenty of things IDA does that we don't do, but the list of things we do they don't is growing.

To start with, we have undo, which is a simple feature but it underlies some design decisions that are going to show up in other features in the near future as well.

Because we have the ability to separate user interactions from our internal analysis we can not only undo, but also better support collaborative editing and upgrading of older saved databases.

In terms of features we already have, we have a static data flow implementation that allows you to query register values at addresses which greatly simplifies a lot of analysis plugins. Here's an example:

http://arm.ninja/2016/03/08/intro-to-binary-ninja-api/

(The domain name is a coincidence, Q was just a beta tester, not officially affiliated with us)

Notice how much more robust and simpler the final implementation of that plugin using our data flow is:

https://github.com/Vector35/binaryninja-api/blob/dev/python/...

Nope, just an unfortunate name collision. We've been using binary ninja as the name of the tool for many years now, but it was a private tool that nobody knew we had it for the first few years for CTFs (this is the python version we open sourced before we started rewriting it) so they just happened to start using a similar team name some time after that.

The domain name time stamps should show that if it matters, though I don't think it really does.

Should be out in a week or two. Most of the code changes are done, we're just taking a break between DEF CON / recuperating from a lot of long nights getting the first release out.

It should only take a day or two once we get working again.

One of the developers here, been planning on doing some coordinated posts about it, just been super busy at DEF CON this week. Happy to answer questions though.

If you do happen to be at DEF CON we're actually having a meet up this evening: https://twitter.com/vector_35/status/762050462195396608

To detect hashes like that, use a debugger that supports memory break points and set a read breakpoint on the instruction you changed. It usually makes it a lot easier to identify where the checksum is calculated.

Not the platform you're asking about, but in Binary Ninja, you right-click on the conditional jump and choose "Always Branch", "Never Branch", or "Invert Branch".

Binary Ninja also supports inline editing of assembly and a custom compiler for dropping simple C replacements directly on top of existing functionality.

There's also Binary Ninja. Still in beta, but available to anyone who requests to join the beta before it's public release: https://binary.ninja

I'm really confused why people bring this up. You're not the only one, so I don't blame you in particular, but it's still strange to me. One of the key elements of CFAA is "without authorization" -- it's literally in the first sentence.

Given that the explicit, stated purpose of these types of challenges (of which there are many, many other examples (https://ctftime.org/)) is to be backed, it'd be pretty weird to think someone could be charged under CFAA for it.

Our first previous version of the game (ghostintheshellcode.com/#pwnadventure2) was also a 3d hackable MMORPG and was released earlier than Hack N Slash. So really it was more like PwnAdventure went 2d. ;-)

There's no sandboxing on the server since all the challenges this year were essentially exploiting the trust relationship between the client and the server (or required reverse engineering that was just hard regardless of where the logic was). We certainly didn't /intend/ for someone to directly exploit the server, though it's always a possibility in these sorts of games. If so, they deserved the points they got (not all the flags were available even if you did hack it as some challenges were outside of the game).

It was also somewhat mitigated by the fact that the game was deployed on AWS instances just for that weekend and it was easy to bring up new instances any time we needed it, so someone cracking the server could certainly cause trouble, but there really wasn't any long-term damage they could do.

I agree -- my Firefox is better for it, but there are definitely some gotchas that irk me. Among them; incompatibility with other plugins I adore, like Tab Mix Plus.

Great work and writeup. I think my favorite part of the whole thing is that you clearly started with the goal (or somewhere early on decided that was the goal) of finding a bug and kept going until you'd landed it.

That's the difference between a true hacker at heart and someone who just stumbles across something. Tenacity.

Fortunately, pay was hardly the rest of it. As I said above, the environment at many contractors is not at all what you'd expect, the overhead much less than usual, and the people are all extremely sharp, good at what they do.

No, as to convincing you of that with the little info that's public -- that's a tougher challenge.

Err, that should be: "asset, not a liability". You get the idea.

I'm quite glad we nabbed that particular hire (your potential intern), and I think he's very happy with his decision as well. Ironically, he was probably one of the better informed people we've hired lately in terms of being aware of what his options are.

I seriously doubt I could do 2x better in industry, especially considering cost-of-living calculations. And our location is an asset, liability. Seriously; a gorgeous beach across the street from the office? And you can actually afford a place on the water if you want? You can't beat that.

I think you're basing your opinions on a mental image you have (and most people have) of who we are and what we do that is inaccurate.

As mentioned in the article, we were a separate company purchased last year. We still operate fairly independently from our corporate overlords (someone actually used that reference when we were first meeting them). We have exactly one layer of management for any given project. Our customers work with a PM at most, but usually also directly with the engineers.

While I'm sure your criticisms are quite accurate for many large government jobs, for us (and a number of others I know of doing some similar work), the situation is quite different.

In regards to people working here because they don't know their other options, let me put it this way -- in the company's entire existence, we've had exactly two employees leave for another job, and it was to another small contractor, not the commercial sector. I'd suggest it's unlikely that the retention rate is so high just because we're all so ignorant of our options. There's a lot of reasons for it -- I'd be happy to talk about it more at Defcon if you're there this year.