Slashdot Mirror
NSA To Release a Free Reverse Engineering Tool (zdnet.com)
The US National Security Agency will release a free reverse engineering tool at the upcoming RSA security conference that will be held at the start of March, in San Francisco. From a report: The software's name is GHIDRA and in technical terms, is a disassembler, a piece of software that breaks down executable files into assembly code that can then be analyzed by humans. The NSA developed GHIDRA at the start of the 2000s, and for the past few years, it's been sharing it with other US government agencies that have cyber teams who need to look at the inner workings of malware strains or suspicious software. GHIDRA's existence was never a state secret, but the rest of the world learned about it in March 2017 when WikiLeaks published Vault7, a collection of internal documentation files that were allegedly stolen from the CIA's internal network. Those documents showed that the CIA was one of the agencies that had access to the tool.
Who knew?
...so you want to monitor who will download it, isn't it ?!?
Eg Ndisasm
Taking assembly at university in the early '90's I used a decompiler in the process.
How is this "a disaster"? What is unique about this one other than the maker?
I thought it was illegal to reverse engineer software?
Have you seen what the Obfuscated C project can do? I wouldn't trust NSA source code beyond 'print "Hello World";' and even that is iffy. God help anyone who touches it if this release is binary only.
How is this different from any other disassembler?
GHIDRA? Monster Zero - somebody @ the NSA's watched a LOT of old "Godzilla" flicks...
APK
P.S.=> Three-headed monster from Mars iirc that tosses lightning bolts out of it's mouth no less ... apk
GHIDRA does not appear in the web https://code.nsa.gov/ .
What is the difference between below?
https://github.com/nsacyber
https://github.com/nationalsec...
Which either above is the oficial page for releasing GHIDRA?
Can GHIDRA support RISC-V? And Intel/AMD/ARM?
Does it come with a free thumbdrive? If not, I won't be interested.
Is that a roll of dimes in your pocket or are you happy to see me?
That's kind of trivial. Tedious and laborious, but trivial - you do not need the NSA to tell you how to do that. If the tool were able to spit out code in some high-level language (even something as low-level as C) that is not unintelligible spaghetti code, that would be something.
Trust us....
When Wikileaks says, it is. Spooks might not like them, but nothing they published so far was wrong.
Also, their reaction to the leaks publication was pretty clear.
Why are people using this kind of language to talk about their leaks? What is the agenda here?
Other than the word violation, there appears to be NOTHING in the original message remotely like "viola" or "voilà".
I have been a long time supporter of IDA Pro, for better than 15 years. Every year I would dig down deep into my pockets and hand over about $600 for my maintenance contract renewal, for my own personal use. My "named" license allowed me to install the product on any machine where I need to analyze something down to the assembly level, and chase the rabbit down the hole. I could code in IDAPython, to script up some magic to analyze things in ways you just could not do with any other tool. Except of course the infamous GHIDRA, which although people I knew at work all used it, I had no direct access to the tool. They said it was better than IDA Pro. Still, there were reasons for them to keep IDA Pro on their tool shelf because no one tool fits every problem.
Well in 2018 HexRays changed the licensing, and removed the "named" licenses from their offerings. For twice the price I could own a single license for one single machine, that was of course not going to be the one I needed to analyze. My desktop machine is essentially a Xen virtualizing service with lots of smaller task-oriented virtual machines. Which single virtual machine do I now choose to run IDA Pro in? Whichever one I choose there will be some other place I need to debug something. The new IDA Pro licensing sucks, and I can not justify that kind of money for software that I can not even run where I need it.
Now I can not wait to get my hands on GHIDRA.
Yeah. Just what I always wanted. Software from the NSA. No need for security updates.
Let the Godzilla jokes begin!
This is not much of a tool. All it has to do is convert the hex instructions into the instruction code representations. If it singles out groups of code, such as I/O routines, then it would be useful, but I doubt it does that.
You can't disassemble what you cant see.
EEPROMS and CPU's now have locked areas - and you cant even get a checksum and inventory to know if something changed. So there will be no effective national security until visibility is improved. I suspect the 5G wrangle is because the Chinese write their own specs and may not have law enforcement flaws built in.
Found the dumbass who can't read the source and point out the flaws.
Yes, obfuscated programming contests can serve as important learning tools for those who want to liberate themselves from continued ignorance driven by fear of the unknown.
I think it's safe to say you won't be doing anything with the program (as far as you know) but programmers simply can't afford the luxury of being ignorant and non-programmers are not well served by inculcating fear. The result of your suggestion is to maintain a small group of elites who ought to be blindly trusted rather than kept in check through software freedom.
I'm not sure what constitutes 'touching' in this context but disassembling the binary and examining how that works (even running the code once understood on a spare computer or VM, perhaps one that isn't networked) should be encouraged particularly for the purposes of providing a free software replacement. Running the program temporarily might be necessary to provide a free software replacement. One hopes that any release comes with complete corresponding source code and build instructions. But really, there's no more reason to trust the proprietary software people run every day than there is to trust any code from the NSA. Proprietary software is often malware. We have no good reason to trust the NSA nor software proprietors; in fact, the proprietors sometimes work with the NSA (like when Microsoft specifically changed Skype to make it easier to spy upon).
Digital Citizen
objdump -D ....