Ghidra - Page 1
Forum section: electronics / general

author: Sherlock Holmes
author_rank: Frequent Contributor
timestamp: January 31, 2023, 12:36:47 am
content: I've been using a rather powerful, feature laden new tool for exploring and analyzing ELF/COFF files (as generated by most MCU development tools and languages).It's namedGhidraand I wondered if others here have used this for anything? It's written and maintained by the National Security Agency FYI.It can disassemble, and analyze these files for a huge number of things.It's able to disassemble a large variety of CPU types, brands, models.

author: floobydust
author_rank: Super Contributor
timestamp: January 31, 2023, 02:08:32 am
content: Ghidra did not work at all for me, seems to be malware now.It seems to be orphaned, after the NSA gave it as public domain, I see it has tons of issues and nobody looking after it.Disassembler output was a few opcodes and then nothing.Thankfully I used it on a junk PC and sure enough running the disassembler the snek logo shows up and a white flash on the screen, and found it corrupted most Notepad++ documents and that cache.Would not use or recommend at all.

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 31, 2023, 02:09:44 am
content: Ghidra works fine for me? It's no IDA but it's good enough.

author: floobydust
author_rank: Super Contributor
timestamp: January 31, 2023, 02:16:29 am
content: 1,204 open issues, 2,378 closedhttps://github.com/NationalSecurityAgency/ghidra/issues8-bit clunkers are in the bug/issues list for long times? so I give it a FAIL

author: T3sl4co1l
author_rank: Super Contributor
timestamp: January 31, 2023, 02:31:06 am
content: Am aware of it; haven't had need to use it yet.Tim

author: Halcyon
author_rank: Unknown
timestamp: January 31, 2023, 03:14:58 am
content: Quote from: Sherlock Holmes on January 31, 2023, 12:36:47 amYep. I used it at University along with IDA Pro for reverse engineering malware.

author: KaneTW
author_rank: Frequent Contributor
timestamp: January 31, 2023, 03:36:25 am
content: Quote from: floobydust on January 31, 2023, 02:16:29 amYou're welcome to pay the 4-5 digits required for an IDA+HexRays license instead.

author: DavidAlfa
author_rank: Super Contributor
timestamp: January 31, 2023, 05:11:05 am
content: I've used it a lot for mcu decompiling and reverse-engineering linux binaries.Pretty capable, 100% free, what else do you what?

author: TomS_
author_rank: Frequent Contributor
timestamp: February 09, 2023, 08:41:48 pm
content: I have used it a lot with some Cisco router reverse engineering projects (68k CPUs).I use it for little bits here and there. It's not perfect, but for something you get for free it's not too bad I think.

author: MarginallyStable
author_rank: Regular Contributor
timestamp: February 09, 2023, 11:30:11 pm
content: QuoteI new release came out today

author: Whales
author_rank: Super Contributor
timestamp: February 10, 2023, 03:45:09 am
content: I used it to reverse engineer my laptop's BIOS to permit replacement of the wifi card:https://halestrom.net/darksleep/blog/047_x131e_repair/A few rough edges that I complain about (eg not always automatically detecting registers to be function arguments) but it worked fine.QuotePerhaps you clicked on a Google sponsored link (*shudder*) and got something that is actually legitimately malware? Lots of popular software gets targeted with lookalike sites.

author: floobydust
author_rank: Super Contributor
timestamp: February 10, 2023, 06:35:42 am
content: Quote from: Whales on February 10, 2023, 03:45:09 am"...created and maintained by the National Security Agency Research Directorate."I started at the software's websitehttps://ghidra-sre.org/and downloaded from the github repo as I recall.I had Notepad++ documents erased and a few reverted to empty with size of 1KB, and others went back months as if retrieved from some old cache. It was weird enough and scuttled a lot of work, so I will not touch NSA S/W. The strobing Cobra snake got me. Another (peer) engineer tried Ghidra for another project and he said it didn't work for him.There are other disassemblers that work for me.