Re: Ghidra - a FOSS RE toolkit from NSA

--===============3649140412421708151==
Content-Type: multipart/alternative; boundary="000000000000a0576d0583a73751"

--000000000000a0576d0583a73751
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

I've been playing around with Ghidra for a couple of days now. Here's my
findings...

What I liked:
- Wide range of supported architectures.
- Built-in architecture-agnostic decompiler that seems to do a pretty
decent job.
- Undo functionality.

What I didn't like or couldn't figure out:
- There's an "Apply Enum", but how do you replace scalars with struct field
offsets or struct sizes like you can in IDA? The decompiler can often work
this out, but that won't help when you're working on handwritten assembly
code that can't be decompiled.
- (real-mode x86) When an offset is assigned to a register (and as such
there is no segment directly associated with that offset at this time, e.g.
MOV SI,0x1234), how do I tell Ghidra that 0x1234 is actually "offset Foo"
in (say) DS. When SI is later used to read from memory, the assembly
listing will correctly display the memory location, but I'd also like to
see it when the offset is assigned to SI. Note: the decompiler seems broken
for this scenario and insists on using CS for the memory read no matter
what I tried.
- No library/interrupt recognition.

I tested it on 6502 code, where it performed reasonably well. For real-mode
x86 it felt nearly unusable, due to the segment-related issues mentioned
above. There's a lot of potential here though, and if Ghidra improves over
time, I can see it becoming my main reverse engineering tool. Right now,
however, I don't think it's ready to replace IDA.

If anyone got real-mode x86 to work properly in Ghidra, I'd love to hear
about it.

Kind regards,

Walter van Niftrik

Op do 7 mrt. 2019 om 00:15 schreef Filippos Karapetis <[email protected]>:

> Great news!
>
> Yesterday, NSA (yes, THAT NSA) released a FOSS RE toolkit. It=E2=80=99s w=
ritten in
> Java, it=E2=80=99s comparable to IDA and it=E2=80=99s free and open sourc=
e!
>
> You can read all about it here:
>
> https://www.zdnet.com/article/nsa-release-ghidra-a-free-software-reverse-=
engineering-toolkit/
>
> Website:
> https://ghidra-sre.org/
>
> Regards
> Filippos Karapetis
> --
> "Experience is the name every one gives to their mistakes" - Oscar Wilde
> _______________________________________________
> Scummvm-devel mailing list
> [email protected]
> https://lists.scummvm.org/listinfo/scummvm-devel
>

--000000000000a0576d0583a73751
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr">I&#39;ve been playing around with Ghidra for a couple of d=
ays now. Here&#39;s my findings...<div><br></div><div>What I liked:</div><d=
iv>- Wide range of supported architectures.</div><div>- Built-in=C2=A0archi=
tecture-agnostic=C2=A0decompiler that seems to do a pretty decent job.</div=
><div>- Undo functionality.</div><div><br></div><div>What I didn&#39;t like=
 or couldn&#39;t figure out:</div><div>- There&#39;s an &quot;Apply Enum&qu=
ot;, but how do you replace scalars with struct field offsets or struct siz=
es like you can in IDA? The decompiler can often work this out, but that wo=
n&#39;t help when you&#39;re working on handwritten assembly code that can&=
#39;t be decompiled.</div><div>- (real-mode x86) When an offset is assigned=
 to a register (and as such there is no segment directly associated with th=
at offset at this time, e.g. MOV SI,0x1234), how do I tell Ghidra that 0x12=
34 is actually &quot;offset Foo&quot; in (say) DS. When SI is later used to=
 read from memory, the assembly listing will correctly display the memory l=
ocation, but I&#39;d also like to see it when the offset is assigned to SI.=
 Note: the decompiler seems broken for this scenario and insists on using C=
S for the memory read no matter what I tried.</div><div>- No library/interr=
upt recognition.</div><div><br></div><div>I tested it on 6502 code, where i=
t performed reasonably well. For real-mode x86 it felt nearly unusable, due=
 to the segment-related issues mentioned above. There&#39;s a lot of potent=
ial here though, and if Ghidra improves over time, I can see it becoming my=
 main reverse engineering tool. Right now, however, I don&#39;t think it&#3=
9;s ready to replace IDA.</div><div><br></div><div>If anyone got real-mode =
x86 to work properly in Ghidra, I&#39;d love to hear about it.</div><div><b=
r></div><div>Kind regards,</div><div><br></div><div>Walter van Niftrik</div=
></div><br><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr"=
>Op do 7 mrt. 2019 om 00:15 schreef Filippos Karapetis &lt;<a href=3D"mailt=
o:[email protected]">[email protected]</a>&gt;:<br></div><blockquote class=3D=
"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(2=
04,204,204);padding-left:1ex"><div dir=3D"auto">Great news!</div><div dir=
=3D"auto"><br></div><div dir=3D"auto">Yesterday, NSA (yes, THAT NSA) releas=
ed a FOSS RE toolkit. It=E2=80=99s written in Java, it=E2=80=99s comparable=
 to IDA and it=E2=80=99s free and open source!</div><div dir=3D"auto"><br><=
/div><div dir=3D"auto">You can read all about it here:</div><div dir=3D"aut=
o"><a href=3D"https://www.zdnet.com/article/nsa-release-ghidra-a-free-softw=
are-reverse-engineering-toolkit/" target=3D"_blank">https://www.zdnet.com/a=
rticle/nsa-release-ghidra-a-free-software-reverse-engineering-toolkit/</a><=
br></div><div dir=3D"auto"><br></div><div dir=3D"auto">Website:</div><div d=
ir=3D"auto"><div><a href=3D"https://ghidra-sre.org/" target=3D"_blank">http=
s://ghidra-sre.org/</a></div><br></div><div dir=3D"auto">Regards</div><div =
dir=3D"auto">Filippos Karapetis</div>-- <br><div dir=3D"ltr" class=3D"gmail=
-m_-8775138925934327922gmail_signature">&quot;Experience is the name every =
one gives to their mistakes&quot; - Oscar Wilde </div>
_______________________________________________<br>
Scummvm-devel mailing list<br>
<a href=3D"mailto:[email protected]" target=3D"_blank">Scummv=
[email protected]</a><br>
<a href=3D"https://lists.scummvm.org/listinfo/scummvm-devel" rel=3D"norefer=
rer" target=3D"_blank">https://lists.scummvm.org/listinfo/scummvm-devel</a>=
<br>
</blockquote></div>

--000000000000a0576d0583a73751--


--===============3649140412421708151==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KU2N1bW12bS1k
ZXZlbCBtYWlsaW5nIGxpc3QKU2N1bW12bS1kZXZlbEBsaXN0cy5zY3VtbXZtLm9yZwpodHRwczov
L2xpc3RzLnNjdW1tdm0ub3JnL2xpc3RpbmZvL3NjdW1tdm0tZGV2ZWwK

--===============3649140412421708151==--