During the RSA conference, the U.S. National Security Agency announced the opening of access to the “Ghidra” reverse engineering toolkit , which includes an interactive disassembler with support for decompiling C code and provides powerful tools for analyzing executables.
The project has been under development for almost 20 years and is actively used by US intelligence agencies to identify markers, analyze malicious code, study various executable files, and analyze compiled code.
In terms of capabilities, the product is comparable to the extended version of the proprietary IDA Pro package , but it is designed exclusively for code analysis and does not include a debugger.
On the other hand, Ghidra has support for decompiling into pseudocode that resembles C (in IDA, this feature is available through third-party plugins), as well as more powerful tools for joint analysis of executable files.
Key features
Within the Ghidra reverse engineering toolkit we can find the following:
- Support for various sets of processor instructions and executable file formats.
- Executable file support analysis for Linux, Windows and macOS.
- It includes a disassembler, an assembler, a decompiler, a program execution graph generator, a module to execute scripts and a large set of auxiliary tools.
- Ability to perform in interactive and automatic modes.
- Plug-in support with the implementation of new components.
- Support for automating actions and extending existing functionality through the connection of scripts in Java and Python languages.
- Availability of funds for teamwork of research teams and coordination of work during reverse engineering of very large projects.
Interestingly, a few hours after Ghidra's release, the package found a vulnerability in the implementation of debug mode (disabled by default), which opens network port 18001 for remote application debugging using the JDWP (Java Debug Wire Protocol).
By default, network connections were made across all available network interfaces, rather than 127.0.0.1 , allowing you to connect to Ghidra from other systems and run any code in the application context.
For example, you can connect to a debugger and abort execution by setting a breakpoint and substitute your code for further execution using the "print new" command, for example, »
print new java.lang.Runtime (). exec ('/ bin / mkdir / tmp / dir') ».
In addition, it is possible to observe the publication of an almost completely revised edition of the open interactive disassembler REDasm 2.0.
The program has an extensible architecture that allows you to connect drivers for additional sets of instructions and file formats in the form of modules. The project code is written in C ++ (Qt-based interface) and distributed under the GPLv3 license. Work supported on Windows and Linux.
The basic package is compatible with PE, ELF, DEX (Android Dalvik), Sony Playstation, XBox, GameBoy, and Nintendo64 firmware formats . Instruction sets supported include x86, x86_64, MIPS, ARMv7, Dalvik, and CHIP-8.
Among the features, we can mention support for interactive IDA-style visualization, multi-threaded application analysis , the construction of a visual progress chart, the digital signature processing engine (which works with SDB files), and tools for project management.
How to install Ghidra?
For those interested in installing this “Ghidra” reverse engineering toolkit , they should know that they must have at least the following:
- 4 GB RAM
- 1 GB for Kit storage
- Have Java 11 Runtime and Development Kit (JDK) installed.
To download Ghidra, you need to go to its official website where you can download it. The link is here.
Once this is done, you will only have to unzip the downloaded package and inside the directory you will find the file “ghidraRun” which will run the kit.
If you want to know more about it, you can visit the following link.