Slashdot Mirror
NSA Releases Ghidra, a Free Software Reverse Engineering Toolkit (zdnet.com)
An anonymous reader writes: At the RSA security conference this week, the National Security Agency released Ghidra, a free software reverse engineering tool that the agency had been using internally for well over a decade. The tool is ideal for software engineers, but will be especially useful for malware analysts first and foremost, being similar to other reverse engineering tools like IDA Pro, Hopper, HexRays, and others.
The NSA's general plan was to release Ghidra so security researchers can get used to working with it before applying for positions at the NSA or other government intelligence agencies with which the NSA has previously shared Ghidra in private. Ghidra is currently available for download only through its official website, but the NSA also plans to release its source code under an open source license in the coming future.
The NSA's general plan was to release Ghidra so security researchers can get used to working with it before applying for positions at the NSA or other government intelligence agencies with which the NSA has previously shared Ghidra in private. Ghidra is currently available for download only through its official website, but the NSA also plans to release its source code under an open source license in the coming future.
So, basically, this is google translate, but for software!
I don't want any software from the NSA. I'll run that North Korean Linux before I run anything from the NSA.
Q sent me!!!!!!!
Wait till it is, otherwise no telling what it contains unless you use it to revers engineer itself.
http://www.peppermalware.com/2019/03/quick-analysis-of-trickbot-sample-with.html
That's a quick review of using Ghidra to analyze Trickbot. It shows the interface and many of the features, with a brief comparison to IDA.
Learning HOW to think is more important than learning WHAT to think.
We'll release the source code Real Soon Now (tm), but for now, here, run this NSA black box on your computer.
Do they really think we're that grotesquely fucking stupid?
Or is that actually the first test to get one of those jobs they spoke of?
Ghidra is released just in time for the Godzilla movie!
With a Three Letter Agency you are never quite sure what they are plotting.
Will this help people remove DRM from software as well? Inquiring minds want to know.
Will the world implode if this were run on Slashcode?
Then let's get everybody we can to click the link, in order to destroy the value of the information that someone happens to have clicked the link.
Reverse engineers in what form? And is it limited to specific languages?
I *really* need the NSA's toolkit to fix all my backdoored Intel procesors!!
The tool is ideal for software engineers...
Yes, there will be good guys who will use this to reverse-engineer malware to design patches. There will also be bad guys who will use it to reverse-engineer patches to design malware.
Here's a scenario: A security researcher discovers a critical vulnerability in Microsoft Windows. Remotely executable. Root-level access. Being a responsible researcher, the information is provided quietly to Microsoft before being announced publicly, so they are given a chance to develop a patch. Somewhere down the road, Microsoft releases a patch.
What happens immediately is that people start reverse-engineering the patch. What modules is it touching? Let's look very closely at those modules, maybe do some fuzzing, see if we can figure out what's exploitable. I once saw Halvar Flake give a talk on this that was both impressive and frightening. A person with his level of skill could potentially develop an exploit by reverse-engineering a patch in a matter of hours. Much faster than many people would be deploying the patch.
I guess we'll find out soon enough. People afraid of it could always run it in a sandboxed area. I wouldn't worry too much about being on a list, you are probably already on it. If the download consists of a stub that downloads a "downloader" like so much crapware today, maybe start to worry :-)
unless you want a TCP port opened that is reachable via internet with remote code execution source
With the NSA in the role of the super-advanced aliens and the rest of humanity as the strugglers in the zone who feast on their junk.
And your three-headed kaiju.
Has anybody reverse engineered it yet, using Ghidra?
You can be sure, this is not considered an advanced tool, worthy of protection. If you are able to use this tool to do something interesting, you might find yourself being contacted by a recruiter from a contractor with a strange name. If government salaries were not borderline poverty level, it might be fun.
Right, the NSA would never attempt something so unsubtle
Reko is already open source. It has a disassembler and a GUI.
https://uxmal.github.io/reko/
https://github.com/uxmal/reko