Ghidra Public ((BETTER)) Download
Agnella Louato
I'm trying to reverse a static library for which I have a header file defining the public API. I get ghidra to parse the file properly and populate the Data Type Manager. The header doesn't include the struct members, just the name. Eg, typedef struct Foo_ Foo;. In the decompiler, looking at a function with a known signature I right click on one of the struct arguments and click Auto Fill in Structure. After doing this the type in the data type manager remains unchanged. Is this expected? This function makes use of many methods and properties of the struct, so it should be possible to infer much about the layout.
You will need to close Ghidra at this point because the GUI for CodeBrowser when analyzing causes nothing but issues. This is where the normal usage of Ghidra will come to a pause. We will be using the Ghidra Headless Analyzer which is a CLI tool for Analyzing or Importing files into a Ghidra database. Open up a new Terminal window (I use Powershell on Windows, Bash on Ubuntu/Linux) and navigate to the Ghidra support directory. In my case this is PS C:\Users\godiwik\Documents_tools\Ghidra\ghidra_10.0.1_PUBLIC\support .
Ghidra is a collection of programs for reverse-engineering of software. It was publicly released in 2019 by the U.S. National Security Agency (NSA), after being used for some time as an internal tool[2]. Ghidra itself is written in Java, but it seems mostly intended to by used on machine-code programs. Ghidra's project format (which, in addition to files relating to analysis, includes the target executables themselves, as these have to be "imported" before anything can be done with them) uses a directory structure instead of a single file; although most of the actual data is hidden in subdirectories, there is a file in the top-level directory whose name is the name of the project followed by ".gpr".
In recent years it has become almost commonplace for leaked National Security Agency (NSA) hacking tools to hit the headlines thanks to being used in attacks such as WannaCry, NotPetya and even the Democratic National Committee (DNC) email breach during Hilary Clinton's U.S. election campaign. But now the NSA has released an open-source, reverse-engineering, hacking tool, called Ghidra into the public domain itself. The question is, would you trust a security tool developed by spooks?
You might be forgiven for thinking, taking the plentiful opinions of security and privacy advocates regarding NSA surveillance techniques into account, that there might be little trust in such a tool from the cybersecurity profession. Forgiven, but wrong. The vast majority of those people I contacted were incredibly welcoming of the Ghidra public release. Take Ian Trump, head of security at AmTrust International, who told me that "there will be folks that will be turned off, it turns out infosec has trust issues, who would have guessed?" However, he also reckons that creating and giving away free professional tools is a non-political gesture which should be applauded and encouraged. "Whatever the case" Trump concluded "this is a gesture which I think is both bold and will be appreciated by the majority of the infosec community." So, is he right? Chris Doman, security researcher at AT&T Cybersecurity, thinks so. His argument being that there really hasn't been any competition to the main reverse-engineering tool, IDA Pro, which "can be cost prohibitive and there are hurdles to obtain." Doman is hopeful that Ghidra may "level the reverse engineering playing field, enabling students and newer security researchers to use a high grade reverse engineering tool."
Not everyone is so positive though. Rufus Caldecott, an operations analyst at the Blackstone Consultancy, thinks one has to "ask why the NSA, a spy agency, is really giving this out for free, when similar tools can cost somewhere in the thousands." He also refers to the Snowden incident, but says "putting aside suspicions regarding the NSA's enigmatic motives, the tool itself seems to have rapidly gathered a reputation among cyber experts for being both extremely advanced and reliable." Others are also less than convinced. "The whole community is wary whenever the NSA or governments release a tool for the general public to use" says Ben McCarthy, senior content developer at Immersive Labs, who continues "I will not be using this tool on a network-connected computer until I have analyzed the source code fully to check it is not doing anything suspicious - as would most people." McCarthy does concede that if all his checks are OK then he sees no reason not to use it. Bridget Kenyon, the global CISO with Thales eSecurity, shares similar concerns. "I'd use it in a sandbox for starters, to monitor what it's doing and see if it comes with any hidden party tricks" Kenyon said, continuing that she would trust it dependent on the open source community "working through the code for surprises." Kenyon mitigates the trust risk a little by adding that the scope of Ghidra's professed capabilities is limited and relatively benign. "It shouldn't be impossible to rely on it for general commercial use" Kenyon says, concluding "but if I were a foreign power, then nope." Suzanne Spaulding is an advisor to Nozomi Networks and a former Department of Homeland Security Under Secretary, she told me that she understands the mistrust but would certainly use Ghidra herself. "First, it's incredibly useful for forensic threat analysts" she explains, continuing "second, it's open source, so NSA would be taking a huge risk that anything malicious it might build in would be detected eventually."
Let's not forget that this isn't the first time that 'spooks' have released security tools into the public domain. Kevin Whelan, CTO at ITC Secure, reminded me that the U.K. Government Communmications Headquarters (GCHQ) released Cyber Chef into the public domain back in 2016. This particular Swiss Army knife tool for analyzing and decoding data is "not as functional as Ghidra but still useful" Whelan says, concluding "more tools = more power."
I am a general assignment reporter on the wealth team. I previously interned at CNN Politics, LinkedIn News, and The MetroWest Daily News in Framingham, Mass. For three years, I cut my teeth at The Daily Orange from reporting with public health and student government beats to working in multiple editing roles.
I've been writing about technology for most of my adult life, focusing mainly on legal and regulatory issues. I write for a wide range of publications: credits include the Times, Daily Telegraph and Financial Times newspapers, as well as BBC radio and numerous technology titles. Here, I'll be covering the ways content is controlled on the internet, from censorship to online piracy and copyright. You can follow my posts by clicking the ' Follow' button under my name.
One question is on our mind: why on Earth give this away for free to everyone on the planet? Perhaps the NSA's enemies are assumed to have better or similar tools, and perhaps the agency internally has moved onto more sophisticated suites, leaving Ghidra ripe for public release.
First I will explain my environment, you would need to adopt this to current versions or systems you might be using. To download Ghidra head over to -sre.org/. Ghidra is built with Java and the current version 9.0 requires at-least OpenJDK 11. I am using Linux and currently OpenJDK 12. Below is an example of my setup. Starting Ghidra with ./ghidraRun the first time will require you to tell Ghidra where your OpenJDK is located. In my case I extracted the tar into /Documents/Ghidra/ with tar -xvf openjdk-12+32_linux-x64_bin.tar.gz
Once you have told Ghidra where you have JDK you should see something similar to the window below.
.
Ghidra uses the concept of workspaces to hold your work. First choose "File->New Project" You have the ability to setup a collaboration project (which is very very cool) or a non-shared project.
You can then create a workspace by choosing "Project->Workspace->add". I chose to setup a non-shared project and pointed it to the workspace under /Documents/ghidra_testing. After this setup you can click on the dragon head to start the CodeBrowser. Your screen will look a bit different since I have already setup my color palette. If you would like to change your appearance the settings are under "Edit->Tool Options"
At this point we are ready to start using the tool to do some RE work. First we need a binary. In this example I have created a simple C++ program and have it here:ghidra_test_binary so you could follow along. Let's first take a quick look at the source code so we know what to expect. The file ghidra_test.cpp can be compiled with "g++ ghidra_test.cpp -o ghidra_test". In this code we have a Base class and a Derived with virtual functions. To view the binary in Ghidra simply press the hotkey "I" or go to File->Import and choose the file. Ghidra should recognize the file as an .elf for x86 64 bit processor. Click though the next couple of popup windows choosing the default selections for now and eventually you will see the disassembly. Now we need to find the start of the program. In the "Program Tree" view on the upper left hand side of the window if we click on ".text" the disassembly window and the decompilation window will update. We can now see __libc_start_main() and our main(). Highlighting something in either window view will highlight the corresponding in the other window. This is a great feature that will allow the user to see how the decompilation is matched with the disassembly. Double clicking on main() will update our view with main's code. Before we dive in too deep, if we take a look under the "Symbol Tree" and the "Data Type Manager" view's we can see that Ghidra has attempted to recognize our some of our class information. It has created a Base and Derived object type under Data Types, and attempted to match the virtual functions under the classes. However, we still need to do a bit of work to make Ghidra show everything correctly.
df19127ead