NSA will release some sort of advanced IDA reversing tool in March

[deepzero]

NSA has developed a software reverse engineering framework known as GHIDRA, which will be demonstrated for the first time at RSAC 2019. An interactive GUI capability enables reverse engineers to leverage an integrated set of features that run on a variety of platforms including Windows, Mac OS and LINUX and supports a variety of processor instruction sets. The GHIDRA platform includes all the features expected in high-end commercial tools, with new and expanded functionality NSA uniquely developed, and will be released for free public use at RSA.


https://www.rsaconference.com/events/us19/agenda/sessions/16608-come-get-your-free-nsa-reverse-engineering-tool

[WhoCares]

wow.

Is it more powerful than IDA?

[Roy25]

Originally Posted by WhoCares

wow.

Is it more powerful than IDA?

If it is "released for free public use".. then I wish it is

[atom0s]

Will be interesting to see how it competes with IDA and BinaryNinja. Given that it is free, if it can give those a run for their money, it could be a good thing and we could see the prices of the other two go down to compete. But, given that it is made by the NSA, there isn't much really pushing for their tool to be anything amazing and there are already worries of trust and what the tool will include in terms of phone-home like telemetry.

[qzr]

Some spoilers could be found on Wikileak: https://search.wikileaks.org/?q=Ghidra

[nikkapedd]

Some code tools are now free from NSA

https://code.nsa.gov/

[chants]

Is this an old resource or just to save face in wake of the leaks?

[atom0s]

The tool has leaked before, but this is a recent announcement that they plan to fully release it from what the various articles have mentioned. The tool was part of some of the WikiLeaks dumps in the past and you can get it already and compile it yourself if you wanted to though.

[SockPuppet]

Originally Posted by atom0s

The tool has leaked before, but this is a recent announcement that they plan to fully release it from what the various articles have mentioned. The tool was part of some of the WikiLeaks dumps in the past and you can get it already and compile it yourself if you wanted to though.

Any links to the leaks? Google not very helpful with this.

[chants]

Any comments about the quality of the decompiler?

[atom0s]

Originally Posted by SockPuppet

Any links to the leaks? Google not very helpful with this.

For full results on Wikileaks:
https://search.wikileaks.org/?q=Ghidra

More specific ones with actual info:
https://wikileaks.org/ciav7p1/cms/page_11628795.html
https://wikileaks.org/ciav7p1/cms/page_51183656.html

There are leaks around the web still that have the Vault 7 files and such, some were uploaded to GitHub and similar. But they are all still findable on Google.

[Mendax47]

There Is A Actual download Link on Wikileaks but can't access to that site

"The Ghidra packages are available on DEVLAN @ \\fs-01.devlan.net\share\NSA\Ghidra"

[chants]

That site is probably internally accessible only and a honeypot from the outside so be careful.

[contactmebyhere]

I heared somewhere that the NSA tool were useful to defeat (at least a part) of themida protector. I hope their source code will help our community.
I'll never run their jar

[chants]

I can't imagine it will be a full-fledged decompiler which beats hex-rays in its current incarnation though. From what I have seen it looks like just another advanced disassembly tool with some basic decompilation tricks.

But did anyone notice how chessgod101 mysteriously deleted his post after I called it out as an obvious honeypot?