Slashdot Mirror
NSA Releases Ghidra, a Free Software Reverse Engineering Toolkit (zdnet.com)
An anonymous reader writes: At the RSA security conference this week, the National Security Agency released Ghidra, a free software reverse engineering tool that the agency had been using internally for well over a decade. The tool is ideal for software engineers, but will be especially useful for malware analysts first and foremost, being similar to other reverse engineering tools like IDA Pro, Hopper, HexRays, and others.
The NSA's general plan was to release Ghidra so security researchers can get used to working with it before applying for positions at the NSA or other government intelligence agencies with which the NSA has previously shared Ghidra in private. Ghidra is currently available for download only through its official website, but the NSA also plans to release its source code under an open source license in the coming future.
The NSA's general plan was to release Ghidra so security researchers can get used to working with it before applying for positions at the NSA or other government intelligence agencies with which the NSA has previously shared Ghidra in private. Ghidra is currently available for download only through its official website, but the NSA also plans to release its source code under an open source license in the coming future.
So, basically, this is google translate, but for software!
Wait till it is, otherwise no telling what it contains unless you use it to revers engineer itself.
http://www.peppermalware.com/2019/03/quick-analysis-of-trickbot-sample-with.html
That's a quick review of using Ghidra to analyze Trickbot. It shows the interface and many of the features, with a brief comparison to IDA.
Learning HOW to think is more important than learning WHAT to think.
With a Three Letter Agency you are never quite sure what they are plotting.
Will the world implode if this were run on Slashcode?
Makes you stupid, but be my guest. You are hardly alone.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
It takes any compiled binary and reverse engineers it into Brainfuck.
Inheritance is the sincerest form of nepotism.
The tool is ideal for software engineers...
Yes, there will be good guys who will use this to reverse-engineer malware to design patches. There will also be bad guys who will use it to reverse-engineer patches to design malware.
Here's a scenario: A security researcher discovers a critical vulnerability in Microsoft Windows. Remotely executable. Root-level access. Being a responsible researcher, the information is provided quietly to Microsoft before being announced publicly, so they are given a chance to develop a patch. Somewhere down the road, Microsoft releases a patch.
What happens immediately is that people start reverse-engineering the patch. What modules is it touching? Let's look very closely at those modules, maybe do some fuzzing, see if we can figure out what's exploitable. I once saw Halvar Flake give a talk on this that was both impressive and frightening. A person with his level of skill could potentially develop an exploit by reverse-engineering a patch in a matter of hours. Much faster than many people would be deploying the patch.
I guess we'll find out soon enough. People afraid of it could always run it in a sandboxed area. I wouldn't worry too much about being on a list, you are probably already on it. If the download consists of a stub that downloads a "downloader" like so much crapware today, maybe start to worry :-)
unless you want a TCP port opened that is reachable via internet with remote code execution source
/ . The NSA? Cool, if course it's my tax dollars that will used to fix it, but cool.
With the NSA in the role of the super-advanced aliens and the rest of humanity as the strugglers in the zone who feast on their junk.
Recall "NSA likely targets anybody who's 'Tor-curious'" https://www.cnet.com/news/nsa-... (July 3, 2014)
Domestic spying is now "Benign Information Gathering"
You can be sure, this is not considered an advanced tool, worthy of protection. If you are able to use this tool to do something interesting, you might find yourself being contacted by a recruiter from a contractor with a strange name. If government salaries were not borderline poverty level, it might be fun.
Reko is already open source. It has a disassembler and a GUI.
https://uxmal.github.io/reko/
https://github.com/uxmal/reko