ghidra VS cutter

Let's see what our beloved software reverse engineering framework Ghidra has to show.

Define war machinery. Contributing to Ghidra?

https://github.com/NationalSecurityAgency/ghidra

Binary Ninja likewise is empty and keeps up just fine as well. It's not a coincidence that the two commercial products that are funding it are both confident enough to put their stuff online like this.

And it's no conspiracy theory or intentional sandbagging, you can see the implementation: https://github.com/decompiler-explorer/decompiler-explorer

and if anyone can improve the other tools performance we'd be happy to accept it. We reached out to the Ghidra devs: https://github.com/NationalSecurityAgency/ghidra/issues/5228 but they didn't have any silver bullets for us either.

Nice, I'll give it a closer look. My only concern so far is memory hooking (still needed for hardware registers), which on Java side was called by FilteredMemoryState [1]. In memstate.cc it looks like just the simpler MemoryState is implemented [2], and there's no equivalent to MemoryAccessFilter. But it might not be that complicated to add...

[1]: https://github.com/NationalSecurityAgency/ghidra/blob/4561e8...

[2]: https://github.com/NationalSecurityAgency/ghidra/blob/4561e8...

Rizin[1]/Cutter[2] projects are stored like text files that work well with git, you could try those tools.

[1] https://rizin.re

[2] https://cutter.re

Everything Hiew can do, Rizin[1] can do too, and is completely free and open source[2] under LGPL3 license. Moreover, it supports more architectures, platforms, and file formats, as well as GUI in Qt - Cutter[3][4]. If something is missing in Rizin but presented in Hiew, please let us know by opening the issue with details.

[1] https://rizin.re

[2] https://github.com/rizinorg/rizin

[3] https://cutter.re

[4] https://github.com/rizinorg/cutter

In Cutter[1][2] we have an idea to implement thes same feature[3] as a plugin, but our priorities lie elsewhere die to the lack of enough hands. Contributions are welcome.

[1] https://cutter.re

[2] https://github.com/rizinorg/cutter

[3] https://github.com/rizinorg/cutter-plugins/issues/3

For this kind of task, using low-level debugger tools is probably better. Rizin[1][2]/Cutter[3][4] could help. We also have GSoC participant this year who works hard on improving debuginfo and debugging support[5]. I personally also like Binary Ninja, they recently made their debugger stable enough[6].

[1] https://rizin.re/

[2] https://github.com/rizinorg/rizin

[3] https://cutter.re/

[4] https://github.com/rizinorg/cutter

[5] https://rizin.re/posts/gsoc-2023-announcement/

[5] https://binary.ninja/2023/05/03/3.4-finally-freed.html#debug...

Something like https://cutter.re/ or https://www.nirsoft.net/utils/dll_export_viewer.html Could possibly give you some insight. I guess the question though is, what are you trying to do with it?

Rizin[1] (and therefore Cutter[2]) supports interactive disassembly and analysis (but not decompilation) of the Python bytecode[3][4]. Apart from that it also supports Java and Lua bytecode for different versions.

[1] https://rizin.re

[2] https://cutter.re

[3] https://github.com/rizinorg/rizin/tree/dev/librz/asm/arch/py...

[4] https://github.com/rizinorg/rizin/blob/dev/librz/analysis/p/...