FOCUS MODE
EXTRACT IOC
Cyber Security News

Ghidra: Open-source software reverse engineering framework – Help Net Security

Cyware

Summary: This content discusses Ghidra, an open-source software reverse engineering framework developed by the National Security Agency (NSA), highlighting its features and capabilities.

Threat Actor: National Security Agency (NSA) | National Security Agency
Victim: N/A

Key Point :

  • Ghidra is an open-source software reverse engineering framework developed by the NSA Research Directorate.
  • It provides high-end software analysis tools for analyzing compiled code across various platforms and supports a wide range of processor instruction sets and executable formats.
  • Ghidra offers features such as disassembly, assembly, decompilation, graphing, scripting, and allows users to develop their own extensions or scripts using Java or Python.
  • It addresses scaling and collaboration challenges in complex software reverse engineering tasks, making it a customizable and extensible research platform.
  • The NSA has utilized Ghidra for analyzing malicious code and generating detailed insights for SRE analysts.

Ghidra, a cutting-edge open-source software reverse engineering (SRE) framework, is a product of the National Security Agency (NSA) Research Directorate.

Ghidra

The framework features high-end software analysis tools, enabling users to analyze compiled code across various platforms, including Windows, macOS, and Linux. Ghidra’s extensive capabilities include disassembly, assembly, decompilation, graphing, scripting, and a host of other functions. It supports a wide range of processor instruction sets and executable formats and can operate in user-interactive and automated modes. Moreover, users have the flexibility to develop their own Ghidra extension components or scripts using Java or Python.

Ghidra addresses scaling and collaboration challenges in complex SRE tasks, offering a customizable and extensible research platform. The NSA has leveraged Ghidra’s SRE capabilities to tackle diverse problems, such as analyzing malicious code and generating detailed insights for SRE analysts to understand potential vulnerabilities in networks and systems better.

Download and install

To install an official pre-built multi-platform Ghidra release:

  • Install JDK 17 64-bit
  • Download a Ghidra release file. The official multi-platform release file is named ghidra___.zip which can be found under the “Assets” drop-down. Downloading either of the files named “Source Code” is not correct for this step.
  • Extract the Ghidra release file
  • Launch Ghidra: ./ghidraRun (or ghidraRun.bat for Windows)

Supported processors: X86 16/32/64, ARM/AARCH64, PowerPC 32/64/VLE, MIPS 16/32/64/micro, 68xxx, Java / DEX bytecode, PA-RISC, PIC 12/16/17/18/24, Sparc 32/64, CR16C, Z80, 6502, 8051, MSP430, AVR8, AVR32, and variants of these processors.

Ghidra is available for free on GitHub.

Must read:


Source: https://www.helpnetsecurity.com/2024/06/17/ghidra-nsa-open-source-software-reverse-engineering-framework

“An interesting youtube video that may be related to the article above”

Views: 0

Tags: WINDOWS, LINUX, MACOS