ghidra
ret-sync

ghidra | ret-sync | |
---|---|---|
130 | 3 | |
53,766 | 2,091 | |
2.1% | 1.1% | |
10.0 | 0.0 | |
6 days ago | 12 months ago | |
Java | C | |
Apache License 2.0 | GNU General Public License v3.0 only |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
ghidra
- Ghidra 11.3 has been released
-
Decompiling and Debugging with Ghidra
Ghidra is an open source tool developed by the U.S. National Security Agency (NSA) for reverse engineering binaries when you don't have access to the source code. It can be used to assist in capture the flag cyber security challenges. Among its many features is that it can convert binaries into C code. Ghidra can run headless or through a Java GUI. This post will focus on using the GUI to decompile and debug a C program given just the binary.
-
Decompiling 2024: A Year of Resurgance in Decompilation Research
In my view one of the most pressing shortcomings of Ghidra is that it can't understand the lifetimes of multiple variables with overlapping stack addresses: https://github.com/NationalSecurityAgency/ghidra/issues/975
Ghidra does have an extensive scripting API, and I've used LLMs to help me write scripts to do bulk changes like you've described. But you would have to think about how you would ensure the name suffix is synchronized as you retype variables during your analysis.
- Ghidra 11.2.1 Released
-
TryHackMe- Compiled
Let's see what our beloved software reverse engineering framework Ghidra has to show.
-
OpenAI is working with the US military now
Define war machinery. Contributing to Ghidra?
https://github.com/NationalSecurityAgency/ghidra
- Ghidra 11.0 Released
-
Dogbolt Decompiler Explorer
Binary Ninja likewise is empty and keeps up just fine as well. It's not a coincidence that the two commercial products that are funding it are both confident enough to put their stuff online like this.
And it's no conspiracy theory or intentional sandbagging, you can see the implementation: https://github.com/decompiler-explorer/decompiler-explorer
and if anyone can improve the other tools performance we'd be happy to accept it. We reached out to the Ghidra devs: https://github.com/NationalSecurityAgency/ghidra/issues/5228 but they didn't have any silver bullets for us either.
-
Show HN: Ghidra Plays Mario
Nice, I'll give it a closer look. My only concern so far is memory hooking (still needed for hardware registers), which on Java side was called by FilteredMemoryState [1]. In memstate.cc it looks like just the simpler MemoryState is implemented [2], and there's no equivalent to MemoryAccessFilter. But it might not be that complicated to add...
[1]: https://github.com/NationalSecurityAgency/ghidra/blob/4561e8...
[2]: https://github.com/NationalSecurityAgency/ghidra/blob/4561e8...
- NSA releases Ghidra version 10.3.3
ret-sync
-
ret-sync+WinDbg+Ghidra - program unavailable
I am trying to connect Ghidra project to WinDbg Preview using ret-sync (https://github.com/bootleg/ret-sync). I think I have everything installed correctly, but in Ghidra console output for ret-sync extension I get:
-
I'm looking for a program-flow highlighting tool. Any ideas?
ret-sync: synchronize a debugger (WinDbg / GDB / LLDB / OllyDbg2 / x64dbg) with a disassembler (IDA / Ghidra / Binary Ninja) in which you can colorize the trace. See the bc command.
- Announcing version 7.6 for IDA Freeware! Includes cloud based decompiler.
What are some alternatives?
x64dbg - An open-source user mode debugger for Windows. Optimized for reverse engineering and malware analysis.
flare-ida - IDA Pro utilities from FLARE team
cutter - Free and Open Source Reverse Engineering Platform powered by rizin
REDRIVER2 - Driver 2 Playstation game reverse engineering effort
rizin - UNIX-like reverse engineering framework and command-line toolset.
tenet - A Trace Explorer for Reverse Engineers
r2ghidra - Native Ghidra Decompiler for r2
radare2 - UNIX-like reverse engineering framework and command-line toolset
rz-ghidra - Deep ghidra decompiler and sleigh disassembler integration for rizin
Ghidra-Cpp-Class-Analyzer - Ghidra C++ Class and Run Time Type Information Analyzer
ghidra-dark - Dark theme installer for Ghidra
obfDetect - IDA plugin to pinpoint obfuscated code
