ghidra
ghidra
Our great sponsors
ghidra | ghidra | |
---|---|---|
126 | 4 | |
47,609 | 5 | |
2.5% | - | |
10.0 | 7.5 | |
5 days ago | 6 months ago | |
Java | Java | |
Apache License 2.0 | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
ghidra
-
TryHackMe- Compiled
Let's see what our beloved software reverse engineering framework Ghidra has to show.
-
OpenAI is working with the US military now
Define war machinery. Contributing to Ghidra?
https://github.com/NationalSecurityAgency/ghidra
- Ghidra 11.0 Released
-
Dogbolt Decompiler Explorer
Binary Ninja likewise is empty and keeps up just fine as well. It's not a coincidence that the two commercial products that are funding it are both confident enough to put their stuff online like this.
And it's no conspiracy theory or intentional sandbagging, you can see the implementation: https://github.com/decompiler-explorer/decompiler-explorer
and if anyone can improve the other tools performance we'd be happy to accept it. We reached out to the Ghidra devs: https://github.com/NationalSecurityAgency/ghidra/issues/5228 but they didn't have any silver bullets for us either.
-
Show HN: Ghidra Plays Mario
Nice, I'll give it a closer look. My only concern so far is memory hooking (still needed for hardware registers), which on Java side was called by FilteredMemoryState [1]. In memstate.cc it looks like just the simpler MemoryState is implemented [2], and there's no equivalent to MemoryAccessFilter. But it might not be that complicated to add...
[1]: https://github.com/NationalSecurityAgency/ghidra/blob/4561e8...
[2]: https://github.com/NationalSecurityAgency/ghidra/blob/4561e8...
- NSA releases Ghidra version 10.3.3
- Ghidra 10.3.2 released!
- Ghirda 10.3.2 released!
- Debugger Ghidra Class
ghidra
-
Show HN: A Ghidra extension that turns programs back into object files
[1] https://github.com/boricj/ghidra/tree/feature/elfrelocatebleobjectexporter
-
Ask HN: Tell us about your project that's not done yet but you want feedback on
I've been working on a specific reverse-engineering technique called _unlinking_ [1] on-and-off for the past 16 months or so. I'm on my third prototype (first a set of Ghidra scripts written in Jython [2], then a fork of Ghidra [3] and now a Ghidra extension [4]) and I've started a blog in order to document it [5], which side-tracked into writing a whole series of articles on reverse-engineering to introduce the topic.
What for, you may ask? Basically I'm trying to decompile a PlayStation 1 video game and I've quickly decided that dealing alone with multiple +500 KiB executables of complete utter spaghetti code wasn't going to work. Instead, I've decided that I'd rather divide-and-conquer the problem, so I've been tooling up to split executables into relocatable object files, in order to decompile those one at a time and _Ship of Theseus_-style my way to success.
Ironically, all of that stuff is so not done that I don't even know what meaningful feedback there could be. My prototypes do work, but only for 32 bit little endian statically-linked MIPS executables. The articles on my blog are draft-quality. As for the decompilation project itself that started all of this, it hasn't seen much progress due to all of those side-quests. The overall topic is so esoteric that so far I've only managed to hear about one group of two persons that tried to do anything remotely similar and one another anecdotal account [6] that this particular skill is very uncommon among reverse engineers.
Personally, I'm starting to think that maybe I could've actually reverse-engineered and decompiled the game in the time I took to get here. I've also tried to engage with Ghidra to upstream the foundations of my modifications in my fork, but after some back-and-forth it became clear that my prototype-grade stuff wasn't industrial-grade and couldn't be merged in its current state, which is why I'm currently reworking the code in my fork as a Ghidra extension.
To those that want to provide feedback after reading all of this: beware, I've had a lot of fun going down that rabbit hole, but this is one hell of a time sink _and_ a particularly tricky mind-bender.
[1] I don't actually _know_ what's the actual name for this technique, given that there are so few resources on it out there. I do know I didn't invent it.
[2] https://github.com/boricj/ghidra-unlinker-scripts
[3] https://github.com/boricj/ghidra/tree/feature/elfrelocateble...
[4] https://github.com/boricj/ghidra-unlinker-extension
[5] https://news.ycombinator.com/item?id=36575081#36590078
[6] https://news.ycombinator.com/item?id=35729232&p=3#35740761
-
Ask HN: Most interesting tech you built for just yourself?
- The relocation synthesizer for MIPS: https://github.com/boricj/ghidra/blob/feature/elfrelocateble...
- The Ghidra analyzer that leverages this synthesizer: https://github.com/boricj/ghidra/blob/feature/elfrelocatebleobjectexporter/Ghidra/Features/Delinker/src/main/java/ghidra/app/analyzers/RelocationTableSynthesizerAnalyzer.java
What are some alternatives?
x64dbg - An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
depsdev - CLI client (and Golang module) for deps.dev API. Free access to dependencies, licenses, advisories, and other critical health and security signals for open source package versions.
cutter - Free and Open Source Reverse Engineering Platform powered by rizin
Pinout.xyz - Source files for the Raspberry Pi Pinout documentation website.
rizin - UNIX-like reverse engineering framework and command-line toolset.
SaunaControl - Makes a Sauna think it's a web server.
r2ghidra - Native Ghidra Decompiler for r2
dizquetv - Create live TV channels from your own media. Access the streams using the simulated HDHomerun tuner or the generated M3U URl.
ret-sync - ret-sync is a set of plugins that helps to synchronize a debugging session (WinDbg/GDB/LLDB/OllyDbg2/x64dbg) with IDA/Ghidra/Binary Ninja disassemblers.
ratarmount - Access large archives as a filesystem efficiently, e.g., TAR, RAR, ZIP, GZ, BZ2, XZ, ZSTD archives
ghidra-dark - Dark theme installer for Ghidra
cardboard - 💽 Cloud storage + management platform for analog video files