Ghidra Alternatives

ghidra reviews and mentions

• Show HN: Ghidra Plays Mario
  10 projects | news.ycombinator.com | 9 Sep 2023

  > I’m not clear on if the bugs you are finding are in Ghidra’s processor model or in the emulator? (Though I think it’s the latter?)

  The project README includes a link to a commit fixing bugs in Ghidra's processor model, here is the author's PR submitting those fixes upstream: https://github.com/NationalSecurityAgency/ghidra/pull/5740

  10 projects | news.ycombinator.com | 9 Sep 2023

  Nice, I'll give it a closer look. My only concern so far is memory hooking (still needed for hardware registers), which on Java side was called by FilteredMemoryState [1]. In memstate.cc it looks like just the simpler MemoryState is implemented [2], and there's no equivalent to MemoryAccessFilter. But it might not be that complicated to add...

  [1]: https://github.com/NationalSecurityAgency/ghidra/blob/4561e8...

  [2]: https://github.com/NationalSecurityAgency/ghidra/blob/4561e8...

• Debugger Ghidra Class
  5 projects | news.ycombinator.com | 19 Jun 2023
• Ask HN: What's the best open source alternative to IDA Pro?
  2 projects | news.ycombinator.com | 20 May 2023

  Ghidra: https://ghidra-sre.org/, https://github.com/NationalSecurityAgency/ghidra

• Ghidra 10.3 released (with Dark Mode).
  2 projects | /r/ReverseEngineering | 12 May 2023
• Ask HN: Most interesting tech you built for just yourself?
  149 projects | news.ycombinator.com | 27 Apr 2023

  I tried to upstream some of my refactorings/modifications to support this, but it was rejected by upstream [1]. I don't blame the Ghidra project for this decision ; my modifications are fairly intrusive (modifying the relocation table after the initial load, extensive refactoring of the ELF support code...) and my workflow is essentially unproved in public.

  By that I mean I have no documentation, no series of technical articles describing this process and no public, non-trivial project to demonstrate it in real life. I do have a currently private decompilation project that uses this successfully [2], but it's not currently public and it's nowhere near finished.

  Also, I only wrote a relocation synthesizer for statically-linked, 32-bit, little endian MIPS ELF. That's a fairly obscure platform, I'd expect most people care about mainstream instruction sets like x86_64 or ARM64.

  If you can suggest a forum where people would be interested in this, I can drop a message there and answer more in-depth questions if you want. So far I've worked on this all on my own and I'm kinda out of the loop from the rest of the reverse-engineering community.

  [1] https://github.com/NationalSecurityAgency/ghidra/pull/5010#i...

• NSA Ghidra software reverse engineering framework
  3 projects | news.ycombinator.com | 27 Mar 2023

  https://github.com/NationalSecurityAgency/ghidra/issues/382

  3. Airgaps may be broken by ultrasound side channels; communication to compromised devices like smartphones is possible (see: speaker-to-gyroscope communication https://ieeexplore.ieee.org/abstract/document/9647842/ ; speaker-to-speaker communication https://arxiv.org/pdf/1803.03422.pdf)

  4. Low bitrate data leaks, like "ghidra is running in this org, decompiling files named....." may be accumulated by the NSA

  This is just zero-day warehousing and passive signals collection with embedded zerodays. It would be hard for security researchers to detect this. I'd happily change my mind if you showed me an audit that looks for beacons and other side channels.

  II. The audits

  Here is the one audit I could find

  https://github.com/NationalSecurityAgency/ghidra/issues/382

  This audit tells us that the code is janky, but doesn't tell us if it's secure. It's just a dump of thousands upon thousands of static analysis errors.

  There's no threat anaylsis in this audit. All it suggests is that the code has so many defects that a serious security audit will very expensive to perform.

  III. Change my mind with evidence

  Please link me to the "heavy audits" of the code that you think should exist. I couldn't find them. Surely you were not bullshitting me. Surely not?!

  tldr;; I think this code is less heavily audited than you can support.

  3 projects | news.ycombinator.com | 27 Mar 2023

  > RE'd ghidra

  What, like, read the source code [1] or reverse engineered a binary? Would be easy(ish) to tell if the code in the binary was different from the source, probably.

  [1]: https://github.com/NationalSecurityAgency/ghidra

  3 projects | news.ycombinator.com | 27 Mar 2023
• Riscv Ghidra Instruction Manual
  2 projects | /r/ghidra | 11 Mar 2023

  For example MIPS: https://github.com/NationalSecurityAgency/ghidra/blob/master/Ghidra/Processors/MIPS/data/manuals/mipsMic.idx

• A note from our sponsor - InfluxDB
  www.influxdata.com | 28 Nov 2023

  Manage all types of time series data in a single, purpose-built database. Run at any scale in any environment in the cloud, on-premises, or at the edge. Learn more →